OpenSSH Fixes Critical Authentication Bypass on musl-Based Linux Systems

OpenSSH has released version 10.6p2 to fix a critical vulnerability that allowed access to passwordless accounts on Linux systems based on musl libc, particularly Alpine Linux without PAM. A remote attacker only needed to know a valid username and submit a password between 257 and 1,024 characters long to bypass authentication, even when the account was configured to accept SSH keys only. The issue stemmed from the interaction between OpenSSH and the behavior of musl’s crypt() function and had been present for years in affected configurations. Alpine has distributed patched packages, and administrators should already have updated OpenSSH, assessed the service’s exposure, and reviewed logs for anomalous access. The severity is high because SSH protects servers, appliances, and containerized environments, while the bypass required neither valid credentials nor prior access to the system.

Source: The Hacker News