OpenSSH Emergency Patch Blocks Alpine Linux Auth Bypass
A critical vulnerability in OpenSSH allowed attackers to bypass authentication on Alpine Linux systems using specially crafted long passwords. The flaw affects accounts with no password set, such as those relying solely on SSH keys.
TL;DR
- OpenSSH released version 10.6p2 to fix a critical auth bypass flaw.
- Attackers could log into password-less accounts using long passwords (257–1024 bytes).
- The issue impacts Alpine Linux systems running the standard openssh-server package.
- Network access and valid account names are required to exploit the vulnerability.
- Alpine has issued updated packages to resolve the issue.
A severe vulnerability has been discovered in OpenSSH that impacts certain Alpine Linux deployments. The flaw allows unauthorized access to accounts configured without passwords—such as those secured exclusively by SSH keys—by submitting passwords of specific lengths.
Exploitation requires network access to the target server, knowledge of a valid account name, and a password between 257 and 1,024 bytes long. Given the widespread use of Alpine Linux in containerized environments, this poses a significant risk to infrastructure relying on key-based SSH authentication.
OpenSSH responded swiftly by releasing version 10.6p2, which resolves the issue. Administrators running affected versions should update immediately to prevent potential unauthorized access.
Vulnerability Details
- The flaw affects Alpine Linux systems using the default openssh-server package.
- Accounts with no password set (e.g., SSH key-only logins) are vulnerable.
- Attackers must submit a password between 257 and 1,024 bytes to trigger the bypass.
- Only users with network access and knowledge of valid usernames can exploit the bug.
- OpenSSH rated the vulnerability as critical due to its potential impact.
Remediation Steps
- Upgrade to OpenSSH version 10.6p2 immediately.
- Ensure all Alpine Linux systems are updated with the latest security patches.
- Audit SSH configurations to confirm proper enforcement of authentication methods.
- Monitor logs for unusual login attempts or patterns indicative of exploitation.
- Restrict SSH access via firewalls where possible to limit exposure.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.