OpenSSH releases patch for login vulnerability affecting Alpine Linux

a laptop computer sitting on top of a white table — Surface / Unsplash

OpenSSH has released a patch addressing a vulnerability that allows login without a password, impacting Alpine Linux. This patch, version 10.6p2, resolves an issue where accounts without passwords could be accessed if the login method permits password authentication. Attackers could log in immediately by entering a password that is 257 characters or more.

This vulnerability is quite specific, requiring compilation with the popular musl library used in small Linux distributions and must not have PAM enabled. Additionally, targeted accounts must be set without passwords. Alpine Linux, well-known among Docker users, typically sets the root account without a password but also disables SSH password login, thus not directly affected.

However, users creating passwordless accounts with root doas permissions may face risks. Many users of Alpine Linux operate applications via Docker, often without SSH installed, which mitigates the risk. Nevertheless, those deploying servers or installing SSH in Docker should verify their configurations promptly.