{
  "id": 18597595,
  "title": "Alpine Linux and OpenSSH patch flaw that’s as bad as it can get",
  "url": "https://urgent.news/2026/11/07/alpine-linux-and-openssh-patch-flaw-thats-as-bad-as-it-can-get",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T00:00:45.000Z",
  "source": {
    "name": "ZDNet",
    "slug": "zdnet",
    "url": "https://www.zdnet.com/tech/alpine-linux-openssh-patch-flaw/"
  },
  "original_language": "en",
  "account": "Alpine Linux, a lightweight server operating system, has been hit with a severe security flaw that allows attackers to bypass password protection and gain access to accounts. The vulnerability, classified as CVE-2026-123158, can be exploited by sending a password between 257 and 1024 bytes long to password-disabled or key-only accounts. This issue arose only days after Alpine Linux patched another security hole in its GitLab implementation. Security experts warn that the flaw exists due to the way OpenSSH, a key component of Alpine Linux, processes long passwords. When built without Pluggable Authentication Modules (PAM), OpenSSH hashes passwords using the crypt() function from the musl library. However, when a password exceeds 256 bytes, crypt() returns *, which matches the default password for key-only accounts, granting attackers unauthorized access. The vulnerability affects Alpine Linux versions 3.21 through 3.24, as well as older versions 3.16 to 3.20. Other musl-based distributions at risk include Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, and Yocto Project-based distributions. While most Linux distributions using glibc's crypt() are not vulnerable, Alpine Linux emphasizes that upgrading the OpenSSH package is crucial to resolving the issue. Users who cannot update should disable PasswordAuthentication in sshd and monitor system activities for any suspicious log entries.",
  "summary": "This dangerous Linux security hole must be patched as soon as possible.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 6,
    "also_reported_by": [
      {
        "outlet": "LWN",
        "title": "Critical security vulnerability affects OpenSSH on Alpine Linux systems",
        "url": "https://urgent.news/2026/11/05/critical-security-vulnerability-affects-openssh-on-alpine-linux",
        "published": "2026-11-05T11:39:10.000Z"
      },
      {
        "outlet": "Hacker News",
        "title": "Alpine Linux Security advisory: OpenSSH-server password authentication bypass",
        "url": "https://urgent.news/2026/11/05/alpine-linux-security-advisory-openssh-server-password-authentication",
        "published": "2026-11-05T14:44:20.000Z"
      },
      {
        "outlet": "Tom's Hardware",
        "title": "Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password",
        "url": "https://urgent.news/2026/11/05/combined-openssh-and-musl-libc-flaws-let-anyone-into-alpine-linux-and",
        "published": "2026-11-05T18:14:56.000Z"
      },
      {
        "outlet": "The Register Science",
        "title": "Get root on a musl Linux system by slamming it with an overly long password",
        "url": "https://urgent.news/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long",
        "published": "2026-11-05T18:29:00.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)",
        "url": "https://urgent.news/2026/11/06/researcher-sshole-a-decade-old-openssh-flaw-lets-attackers-use-a",
        "published": "2026-11-06T16:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}