Citiverse è uno spazio aperto a tutte le comunità. Se vuoi aprire un gruppo locale o una sezione per la tua organizzazione, puoi contattare gli amministratori: pagina dei contatti.
sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt
-
OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.
The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.
sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt
Critical OpenSSH authentication bypass on musl Linux without PAM: accounts locked with * accept any password 257-1024 characters long. Fixed in 10.6p2.
Threat Landscape (threatlandscape.io)
-
OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.
The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.
sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt
Critical OpenSSH authentication bypass on musl Linux without PAM: accounts locked with * accept any password 257-1024 characters long. Fixed in 10.6p2.
Threat Landscape (threatlandscape.io)
It says OpenWrt is affected but it also says Dropbear isn't affected. OpenWrt uses Dropbear by default. So stock OpenWrt is not affected?
Ciao! Sembra che tu sia interessato a questa conversazione, ma non hai ancora un account.
Stanco di dover scorrere gli stessi post a ogni visita? Quando registri un account, tornerai sempre esattamente dove eri rimasto e potrai scegliere di essere avvisato delle nuove risposte (tramite email o notifica push). Potrai anche salvare segnalibri e votare i post per mostrare il tuo apprezzamento agli altri membri della comunità.
Con il tuo contributo, questo post potrebbe essere ancora migliore 💗
Registrati Accedi
Citiverse è un progetto che si basa su NodeBB ed è federato! | Categorie federate | Chat | 📱 Installa web app o APK | 🧡 Donazioni | Privacy Policy