Critical OpenSSH Vulnerability Allows Bypass of SSH Authentication on Alpine Linux via Long Passwords

A critical vulnerability in OpenSSH enables attackers to bypass SSH authentication on Alpine Linux servers by exploiting long passwords (257-1024 bytes), allowing access to passwordless accounts. The flaw was addressed in OpenSSH 10.6p2, with Alpine Linux providing updated packages to mitigate the risk.

Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long.

OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every

Read original article