An extremely long password could get attackers into some Alpine servers running OpenSSH
Version 10.6p2 closes a hole on systems using the musl C library, where locked accounts still accepted a password.
OpenSSH last Thursday released version 10.6p2 of its portable edition to close a hole that let attackers on certain Linux systems log into accounts for which password login had been disabled. The problem affects systems built on the musl C library, such as Alpine Linux, which is widely used in containers and cloud images. The discoverer, Özgün Kültekin of Wakefield, named the flaw sshhole, Cyber Security News reports.
The flaw requires a specific configuration: password login is enabled, PAM is disabled (the default on Alpine), one account has an asterisk instead of a password hash and another account has a real hash. A password of 257 to 1,024 characters is then accepted for the locked account. According to Threat Landscape, the cause lies with musl, which returns an asterisk instead of an empty value when hashing fails, and that asterisk then matches the field of the locked account.
Alpine has patched packages ready for its supported releases as well as older branches. Anyone who cannot update right away is advised to disable password login, after first checking that key-based login works. Systems using PAM, glibc-based distributions and containers without a running SSH server are not affected.