Alpine Linux Security advisory: OpenSSH-server password authentication bypass

If you use Alpine Linux and log in via SSH using passwords, your servers are now vulnerable to unauthorized access without any credentials.

Alpine Linux has issued a security advisory for a critical vulnerability in its OpenSSH-server package. The flaw, detailed in OpenSSH 10.6p2 release notes, allows an unauthenticated attacker to bypass password authentication and log in to affected systems. The vulnerability is triggered when an attacker sends a long password (257-1024 bytes) to an account with no password set (indicated by '*' in the password field), provided the system has at least one other account with a '$5$' or '$6$' password hash. Exploiting this requires network access to the SSH port, the name of an account with an unset password (common for key-only or directory-sourced accounts), and at least one account with a password hash. All Alpine Linux releases from 3.16 through 3.24 and edge are affected if password authentication is enabled and the system meets the criteria. Users are advised to update the openssh package immediately and restart the sshd service, or, as an alternative, disable password authentication in the sshd configuration.

This vulnerability exposes a fundamental flaw in how Alpine Linux's default SSH configuration handles password authentication under specific conditions, particularly for accounts lacking passwords. The bypass relies on a peculiar interaction with password hashing mechanisms and a specific length of input, suggesting that the security model may not have adequately anticipated or tested such edge cases. The widespread impact across numerous Alpine releases indicates a systemic issue that could affect a significant number of lightweight and containerized deployments where SSH is commonly used for remote administration.

Organizations running Alpine Linux that have not yet updated their OpenSSH package or disabled password authentication face an immediate and severe security risk. The ease of exploitation, requiring only network access to the SSH port and specific account configurations, means that even systems that were previously considered secure by default could now be compromised. Proactive system administrators must prioritize patching or reconfiguring their SSH daemons to mitigate this critical vulnerability, especially given the advisory's urgency.