OpenSSH flaw reportedly allows login to password-disabled musl-based Linux accounts
A newly disclosed OpenSSH vulnerability, dubbed "*sshole", reportedly lets attackers log in to some Alpine Linux and other musl-based accounts that block password authentication by submitting an oversized password.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- OpenSSH
- Product
- sshd
- Status
- Reported, not confirmed
- First seen
Summary
A newly disclosed OpenSSH vulnerability, dubbed "*sshole", reportedly lets attackers log in to some Alpine Linux and other musl-based accounts that block password authentication by submitting an oversized password. The report comes from BleepingComputer, which describes the flaw as newly disclosed.
What to do
Check whether any servers run OpenSSH on Alpine Linux or other musl-based distributions.
Apply the OpenSSH or distribution patch as soon as it is available.
Restrict SSH access to trusted networks until patched.
Review authentication logs for unexpected logins.
Timeline
- Made public by Mastodon
- First seen by cve.now1 day
- Record last updated
Evidence 5
- SocialMastodon
“* sshd(8): avoid password authentication bypass that is exploitable through sshd(8) that affects some Linux systems when built and run with PAM support disabled.”
- SocialMastodon
“Update Alpine Linux OpenSSH servers to OpenSSH 10.6p2 now to fix a critical password authentication bypass affecting passwordless accounts.”
- SocialMastodon
“A newly disclosed vulnerability in OpenSSH allows unauthenticated remote attackers to gain access to certain musl-based Linux systems using a specially crafted password of 257 bytes or more.”
- PressBleepingComputer
“A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password.”
+1 more: BleepingComputer on Bluesky - Socialoss-security
“"sshole": password authentication bypass: OpenSSH + musl libc”
+4 more: oss-security, oss-security, oss-security, oss-security
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-f2f032fedb
Has OpenSSH confirmed it?
Mastodon, Mastodon and Mastodon report it. No statement from OpenSSH has reached cve.now yet.Source: Mastodon, Mastodon, Mastodon, BleepingComputer, oss-security
What should OpenSSH users do?
Check whether any servers run OpenSSH on Alpine Linux or other musl-based distributions. Apply the OpenSSH or distribution patch as soon as it is available. Restrict SSH access to trusted networks until patched. Review authentication logs for unexpected logins.