Update now: critical OpenSSH flaw allows password bypass on Alpine Linux

[PhotonBurst16]

Anyone running Alpine Linux servers with SSH should update straight away. Cybersecurity News reports a critical flaw that affects Alpine and some other systems using musl libc, when sshd runs without PAM

The problem comes from how musl handles an overly long password. It returns an asterisk as an error value, so accounts with an asterisk in their password field can be logged into with any very long password, as long as at least one other account has a normal password hash

Alpine says exploitation needs only one connection and no repeated attempts. Official tiny cloud images from version 3.18.11 to 3.24.3 could even lead to root access through passwordless doas, and the flaw was reported by Özgün Kültekin

Fixes are available in OpenSSH 10.6p2 and Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4, and sshd must be restarted after updating. As a stopgap, set PasswordAuthentication to no, while servers with UsePAM enabled and containers without sshd are not affected

Alpine's advice is to treat machines as compromised if unauthorised access cannot be ruled out, which is a serious step. The safest habit is to use SSH keys and turn off password logins entirely, which also blocks this attack. If you run Alpine anywhere, check your versions today

Do you still allow password logins over SSH? And how quickly do you usually patch your servers?

OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Serverscybersecuritynews.com