Alpine Linux users running sshd must update openssh immediately to close a critical password authentication bypass vulnerability. The flaw allows attackers to log in without a password if specific conditions are met. Affected systems run Alpine 3.21 through 3.24 and edge, with the issue present in older unsupported releases as well.
The vulnerability stems from how the SSH server handles long passwords when PAM is disabled and certain password hash types exist. Users unable to update should disable password logins entirely. Two fixed package versions are available: 3.21.10, 3.22.8, 3.23.8, and 3.24.4.
After upgrading, a restart of the sshd daemon is required for the changes to take effect. The issue impacts accounts with no password set (marked with *) and those using $5$ or $6$ password hashes. Cloud images configured via cloud-init are not affected due to default password restrictions.
The OpenSSH 10.6p2 release notes contain full details. No CVE identifier had been assigned at the time of writing. Docker and container users not running sshd are not affected.
Source: Hacker News · Summarized by HeadlinesBriefing