Alpine Linux Security advisory: OpenSSH-server password authentication bypass
Alpine Linux users of the sshd server are urged to update the openssh package immediately to prevent a security vulnerability that allows attackers to bypass password authentication. By sending a lengthy password, an attacker can gain unauthorized access to an account with no password set. This issue affects all Alpine releases from 3.21 through 3.24 and edge, as well as older releases up to 3.20.
To mitigate the risk, disable password logins by setting PasswordAuthentication no in the sshd configuration or upgrade to the fixed package version. After upgrading, restart the sshd daemon to apply the changes.
Written by urgent.news from Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
