Alpine Linux has issued OpenSSH updates for a flaw that lets a remote attacker bypass password authentication and access accounts with no password set under specific conditions.
Alpine’s Nov. 5 advisory says an attacker must know the target account name, reach the server’s SSH port and encounter a system with password authentication enabled. The issue affects Alpine’s standard openssh-server package and openssh-server-pam when UsePAM no is set.
The target account must have an asterisk in its password field, and another local account must have a password hash beginning with $5$ or $6$. Alpine says an input between 257 and 1,024 bytes can trigger the bypass.
The advisory traces the problem to musl, a C standard library used by Alpine Linux. Its error marker for oversized input matches the placeholder used for accounts without a password, Alpine said.
OpenSSH’s Nov. 5 release notes describe a fix for affected Linux systems using musl without PAM. Alpine lists patched packages for branches 3.16 through 3.24 and edge. After installing an update, administrators should restart sshd; Alpine also advises disabling password authentication and restarting the daemon as a workaround for systems that cannot be updated.
