Technology
Alpine Linux warns of OpenSSH password authentication bypass vulnerability
Advisory says attackers who can reach an SSH port may log in without a password on affected Alpine releases.
The short version
- Alpine Linux issued a security advisory on an OpenSSH-server password authentication bypass that lets attackers with SSH port access log in without a password.[Hacker News]
- The advisory says affected releases include 3.21 through 3.24 and edge, plus older releases 3.16 to 3.20.[Hacker News]
- The issue was reported by Özgün Kültekin of Wakefield, and no CVE identifier had been assigned when the advisory was written.[Hacker News]
- Security researcher Ozgun Kultekin says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on musl C library systems.[Slashdot]
Key facts
- An OpenSSH-server password authentication bypass lets attackers with SSH port access log in without knowing a password.[Hacker News]
- The advisory states that no CVE identifier had been assigned at the time of writing.[Hacker News]
- The advisory says affected releases include Alpine 3.21 through 3.24 and edge, plus older releases 3.16 to 3.20.[Hacker News]
- The issue was reported by Özgün Kültekin of Wakefield.[Hacker News]
- Security researcher Ozgun Kultekin says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library.[Slashdot]
What remains uncertain
- Whether the flaw dates to 2016 rests on one researcher's account and is not independently confirmed in the provided reporting.[Slashdot]
- No CVE identifier had been assigned when the advisory was written, so the vulnerability lacks a standard public identifier.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.