OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

OpenSSH released an emergency critical update (version 10.6p2) to address a vulnerability that allows attackers to bypass SSH authentication on Alpine Linux systems by using long passwords (257–1,024 bytes) to log in to passwordless accounts. The flaw affects systems running OpenSSH without PAM, where password authentication is enabled and at least one local account has a password hash. The vulnerability stems from interaction between OpenSSH and musl C library, and impacts Alpine Linux, OpenWrt (if OpenSSH is installed), Buildroot, and Yocto. No CVE has been assigned yet, and no active exploitation has been reported.

AI-extracted · verify before operational use