OpenSSH Issues Emergency Fix for Flaw Bypassing Auth on Alpine Linux

· Cybersecurity

OpenSSH released an emergency fix, rated critical, for a flaw that lets attackers log in to Alpine Linux and other musl-based Linux accounts configured to block password authentication, including SSH key-only accounts. An attacker needs network access to the server, a valid account name and a password between 257 and 1,024 bytes long, which is handled in a way that bypasses the password-disabled setting. The affected package is the standard openssh-server on some Alpine Linux servers. The vulnerability was publicly dubbed "*sshole." OpenSSH has published a new version containing the fix, and operators of affected musl-based systems are being urged to upgrade promptly because exploitation requires no special position beyond reachability of the SSH service.

Why it matters：Many container and edge deployments run Alpine, so a critical authentication bypass in OpenSSH exposes a broad base of internet-facing servers and pressures teams to patch fast.

Key points

  • Attackers need network access, an account name and a 257–1,024 byte password
  • Accounts with password authentication disabled, such as key-only accounts, can be logged into
  • The standard openssh-server package on some Alpine Linux servers is affected

Sources (original reporting)

More stories from this day