OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability affecting Linux systems using musl libc without PAM, such as Alpine Linux. The OpenSSH team urges immediate action: set Password Authentication=no or disable SSH on these systems. The flaw does not impact non-Linux systems, Linux/glibc setups, or those using PAM for authentication.
While the root cause lies outside OpenSSH, the team emphasized rapid mitigation due to the growing threat of AI-driven bug rediscovery within hours of disclosure. Long embargoes are now seen as risky, favoring attackers. The release was made swiftly after learning of the issue just yesterday.
Thanks are extended to Özgün Kültekin of Wakefield for reporting the bug and to Alpine Linux developers for their prompt response.
Source: Hacker News · Summarized by HeadlinesBriefing