OpenSSH fixes flaw that exposed passwordless Alpine Linux accounts
The flaw could let attackers access some accounts without a password by submitting an unusually long one. It affects certain OpenSSH configurations on Alpine Linux and potentially other musl-based systems.
OpenSSH released version 10.6p2 to fix a flaw that could let attackers log in to some passwordless accounts on Alpine Linux servers. The issue involves OpenSSH running with musl and without PAM. The Hacker NewsArs TechnicaBleepingComputer
An attacker needs network access, an account name and a password between 257 and 1,024 bytes long. Password logins must be enabled, and another account on the machine must have a password. The Hacker NewsCyber Daily
Alpine Linux has issued fixed packages, while disabling password logins also blocks the attack. OpenSSH says systems using glibc or PAM for password checks are not affected. The Hacker News