Alpine Linux Discloses OpenSSH Authentication Bypass Vulnerability, Fix Released

on November 6, according to an Alpine Linux security advisory, OpenSSH servers under certain configurations contain a password authentication bypass vulnerability, allowing attackers to log into passwordless accounts using excessively long passwords. Binance co-founder CZ alerted users to apply the fix.

The official advisory notes that the affected conditions include password authentication being enabled on the server, using an OpenSSH configuration without PAM, and the machine hosting both passwordless accounts and local accounts with specific password hashes simultaneously. Attackers must know the target username and submit a password ranging from 257 to 1024 bytes.

Alpine has provided patched packages for relevant versions and recommends that users restart sshd after updating OpenSSH. Users unable to update temporarily may disable password authentication and restart the service.