Critical security vulnerability affects OpenSSH on Alpine Linux systems
Version 10.6p2 of OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use musl libc with PAM disabled, such as Alpine Linux . OpenSSH developer Damien Miller said : If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems…
Alpine Linux users of the sshd server are urged to update the openssh package immediately to prevent a security vulnerability that allows attackers to bypass password authentication. By sending a lengthy password, an attacker can gain unauthorized access to an account with no password set. This issue affects all Alpine releases from 3.21 through 3.24 and edge, as well as older releases up to 3.20.
To mitigate the risk, disable password logins by setting PasswordAuthentication no in the sshd configuration or upgrade to the fixed package version. After upgrading, restart the sshd daemon to apply the changes.
Written by urgent.news from Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
