OpenSSH releases 10.6p2 to block oversized-password login bypass

First reported by RuntimeWire at · Updated · 7 sources

The flaw affects Linux systems using musl libc without PAM, including some Alpine Linux servers, and can expose accounts intended for key-only access. According to The Hacker News, attackers need network access, an account name and a password between 257 and 1,024 bytes long to exploit the vulnerability.

  • RuntimeWire reports that operators were urged to disable password authentication or SSH.

Covered by 7 publishers within 25 hours of the first report.

Reporting7

RuntimeWire OpenSSH 10.6p2 ships a password bypass workaround for musl Linux systems · RuntimeWire Staff
Cyber Security News OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers · Guru Baran
The Hacker News OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux · info@thehackernews.com (The Hacker News)
BleepingComputer OpenSSH flaw lets attackers log into password-disabled Linux accounts · Lawrence Abrams
Tom's Hardware Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password · Bruno Ferreira
Ars Technica Meet *sshole, the vulnerability that lets hackers SSH into Linux devices · Dan Goodin
SecurityWeek OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass · Ionut Arghire

Discussion

Hacker News 1 points, 1 comments