Cyber ·
Password authentication bypass in OpenSSH 10.6p2 on musl libc with PAM disabled
Security advisory: OpenSSH 10.6p2 fixes a password authentication bypass on systems using musl libc with PAM disabled. Alpine Linux is cited as an affected system, according to the oss-sec mailing list post of November 5.
The advisory states that OpenSSH 10.6p2 fixes a password authentication bypass on systems that use musl libc and have PAM disabled. Alpine Linux is cited as one of the affected systems. The post appeared on the oss-sec list on November 5, written by a community maintainer, and points to the official OpenSSH release notes and a separate technical description of the flaw. The excerpt in the feed is cut off before it details the full condition, which involves accounts with an invalid password hash field, so this summary cannot confirm every affected scenario. The original text is a machine translation of the feed. To verify, read the official OpenSSH release notes and the full oss-sec post, identify the installed version on your servers, and follow your operating system vendor's guidance.
Original source: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc