4
sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt (threatlandscape.io)
submitted 1 day ago by to c/technology@midwest.social
comment fedilink hide all child comments
 

OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.

The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.

other discussions
29
sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt (threatlandscape.io)
submitted 1 day ago by to c/technology@lemmy.ml
2 comments fedilink hide all child comments
 

OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.

The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.