Critical OpenSSH Auth Bypass Flaw Lets Long Passwords Circumvent Authentication on Alpine Linux
What Happened — OpenSSH disclosed a critical authentication bypass flaw that affects the openssh-server package shipped with Alpine Linux. An attacker who can reach the SSH service, knows a valid account name, and supplies a password between 257 bytes and 1 024 bytes can log in to accounts that have no password (e.g., key‑only accounts). The bug stems from improper handling of unusually long password buffers, allowing the authentication routine to skip password verification entirely. OpenSSH released version 10.6p2 as an emergency fix, and Alpine Linux has published patched packages for all supported releases.
Why It Matters for Trust & Control Assurance — The issue directly challenges the access‑control objective of ensuring only authorized identities can obtain system access.
Who Is Affected — Any organization running Alpine Linux servers with the default OpenSSH package, spanning cloud‑infrastructure providers, SaaS platforms, and on‑premises workloads.
Recommended Actions —
- Upgrade OpenSSH to version 10.6p2 or later on all Alpine Linux hosts.
- Verify package versions via your configuration management tool or package inventory.
- Enforce password‑length policies that reject passwords >256 bytes.
- Enable and review SSH authentication logs for anomalous login attempts.
Technical Notes — The vulnerability is triggered by a buffer‑handling error in the SSH daemon; no CVE identifier was disclosed at the time of reporting. Exploitation requires network access, a valid username, and a crafted long password. Source: The Hacker News