OpenSSH Authentication Bypass Vulnerability Affects Password-Disabled Accounts on musl-based Linux
CVE-like flaw allows authentication using oversized passwords on accounts with password authentication disabled
Key Takeaways
- OpenSSH vulnerability allows authentication bypass on accounts with password authentication disabled.
- Affected systems include Alpine Linux and other musl-based Linux distributions.
- The bypass is triggered by providing any password to accounts normally protected against password-based login.
- No official CVE or patch has been released as of the initial disclosure.
Related Security News
Hackers backdoor Linux servers using trojanized CWP web server
Researchers have identified a new Linux malware, CWPdoor, being distributed through a trojanized version of cwpsrv, the web server component of the Control Web Panel (CWP) management interface. The attack replaces the legitimate binary with a compromised version, providing unauthorized remote access to affected Linux servers.
OpenSSH Emergency Fix Addresses Critical Authentication Bypass Vulnerability on Alpine Linux
OpenSSH has released version 10.6p2 to address a critical vulnerability that allows attackers to bypass authentication on Alpine Linux servers. The flaw permits login to accounts lacking passwords, such as SSH key-only accounts, when a password field contains between 257 and 1,024 bytes. Alpine Linux has published fixed packages for all supported releases. Users are urged to upgrade immediately to mitigate the risk of unauthorized access.
