OpenSSH Releases Emergency Fix for Authentication Bypass Affecting Alpine Linux and Other Musl-Based Systems
OpenSSH has released an emergency security update to address an authentication bypass vulnerability affecting systems using the musl C library, such as Alpine Linux. The flaw could allow remote attackers to gain unauthorized access if password authentication is misconfigured.
Why it matters
This vulnerability poses a critical security risk to infrastructure relying on Alpine Linux, requiring immediate patching or configuration changes to prevent unauthorized access.
OpenSSH has released an emergency security update to address a critical authentication bypass affecting certain Linux systems, warning administrators that vulnerable configurations could allow remote attackers to access accounts without valid credentials.
Released on 5 November, Portable OpenSSH 10.6p2 introduces a workaround for a vulnerability involving the interaction between the SSH server and musl, the C library used by Alpine Linux. The exposure concerns systems handling password authentication without Pluggable Authentication Modules, or PAM. OpenSSH credits the discovery to Özgün Kültekin of Wakefield.
The disclosure creates an urgent operational issue for organisations that assume an account used exclusively with SSH keys cannot accept a password. Under the affected configuration, that assumption can fail: the password-validation process can incorrectly treat an error response as a successful match.
Also covering this story
One other newsroom covered this event. We read that version too.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in