Alpine Linux Discloses OpenSSH Authentication Bypass Vulnerability, Fix Released

According to TechFlow, on November 6, Alpine Linux security advisories reported that OpenSSH servers under certain configurations contain a password authentication bypass vulnerability, allowing attackers to log in to accounts without passwords using excessively long passwords. Binance co-founder CZ urged users to apply the fix.

The advisory said the affected conditions include servers with password authentication enabled, OpenSSH configurations that do not enable PAM, and machines that have both passwordless accounts and local accounts using specific password hashes. Attackers must know the target account name and submit a password of 257 to 1024 bytes.

Alpine has released fix packages for affected versions. Users are advised to update OpenSSH and restart sshd. Users who cannot update immediately can disable password authentication and restart the service.

Source: TechFlow