Alpine Linux : openssh-server password authentication bypass

Alpine Linux users of the sshd service are advised to update the openssh-server package immediately to prevent a password authentication bypass vulnerability. This exploit allows attackers to login without a password if the target machine has at least one account with a $5$ or $6$ password hash. The attacker needs only one connection to succeed, and it works every time, requiring no retries.

To address this issue, users should disable password logins by setting PasswordAuthentication no in the sshd configuration, and then restart the daemon. Users who cannot update the package should at least disable password logins until an update can be implemented. This vulnerability affects all Alpine releases from 3.21 through 3.24, as well as older releases that no longer receive regular updates.

Affected images from the official tiny-cloud series include versions from 3.18.11 through 3.24.3. To prevent future exploitation, users are advised to review doas use and recently created users, files, and authorized keys on exposed machines.