Critical · 1 source · latest 7h

OpenSSH emergency fix for flaw letting long passwords bypass SSH login on Alpine Linux

CRITICAL · VULNERABILITYOpenSSHredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

A critical authentication bypass in OpenSSH affects some Alpine Linux servers running the standard openssh-server package. An attacker with network access, a valid account name and a password of 257 to 1,024 bytes can log in to accounts that have no password, including SSH key-only accounts. The excerpt does not give a CVE identifier or the affected package versions. OpenSSH fixed it in 10.6p2, and Alpine has published fixed packages. Defenders should upgrade OpenSSH to 10.6p2 or the Alpine fixed packages and check which hosts run openssh-server on Alpine.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Update OpenSSH to version 10.6p2 or later.
Install the fixed openssh-server packages that Alpine Linux has published.
Check whether any Alpine Linux servers run openssh-server and have accounts without passwords.

Written by AI from the sources, checked against them

Read the full story at the source