Alpine Linux Security advisory: OpenSSH-server password authentication bypass
Alpine Linux has issued a security advisory regarding a critical password authentication bypass vulnerability in OpenSSH-server. Users are urged to update their packages immediately or disable password authentication to prevent unauthorized access.
Why it matters
This is a high-severity security flaw that allows attackers to bypass authentication, posing a significant risk to any server running the affected software.
If you run sshd on Alpine Linux, update openssh now and restart sshd . Upgrading the package alone does not replace the running daemon.
If you cannot update yet, at least disable password logins: set PasswordAuthentication no in your sshd configuration and restart sshd . Either one closes the hole.
An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.
The attacker needs the name of an account whose password field is * (an account with no password set, which is normal for key-only accounts), and needs the machine to have at least one other account with a $5$ or $6$ password hash. The attacker then sends a very long password (257 to 1024 bytes). One user with a password is enough: it makes every account without one reachable.
Also covering this story
One other newsroom covered this event. We read that version too.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in