Skip to content
securitytabs

Covered by 3 outlets — first reported by The Hacker News, Nov 5, 16:42 UTC

OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

MentionsOpenSSH

Summary

A newly disclosed OpenSSH flaw, nicknamed "sshole", lets attackers log in to accounts that have password login disabled, such as key-only accounts, on Alpine Linux and other Linux systems that use the musl library without PAM. An attacker needs network access to the server, an account name and an oversized password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released a fixed version, and Alpine has published fixed packages.

AI summary by the SecurityTabs newsroom, checked against The Hacker News, BleepingComputer, SecurityWeek. Read the outlets below for the full story.

SecurityTabs reportupdated 3h agoOpenSSH releases emergency fix for login bypass on Alpine and other musl-based Linux

Continue reading

3 outlets, in the order they reported it.

  1. The Hacker NewsFirst report

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

    Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package.

    Read at The Hacker News Details

  2. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

    A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password.

    Read at BleepingComputer Details

  3. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

    On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.

    Read at SecurityWeek Details

Explained

The technology and terms in this story. Learn more