OpenSSH rushes patches for 'SSHole' authentication bypass
VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
OpenSSH is rushing out patches for an authentication bypass nicknamed 'SSHole'. The flaw affects Linux distributions that use musl libc without PAM, where some accounts accept any password between 257 and 1024 characters. The article gives no CVE identifier or affected versions. Defenders should check whether their Linux systems use musl libc without PAM and apply the OpenSSH update from their distribution as soon as it is available.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether your Linux systems use musl libc without PAM.
- Apply the OpenSSH patch from your Linux distribution as soon as it is released.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
SecurityWeek