ThinkFacility Sign in
  1. Home
  2. Security
  3. OpenSSH
HighActively exploitedOpenSSH

OpenSSH before 10.6p2 on Alpine and other musl Linux: sshd password login bypass, update now

Anyone running an SSH server on Alpine Linux, or in an Alpine-based Docker image, with password logins turned on.

How to fix it

You haveUpdate to
< 10.6p2→10.6p2

Check your version

Your OpenSSH version
ssh -V

Update

Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade openssh-client openssh-server
macOS, only if you installed it with Homebrew
brew update && brew upgrade openssh
macOS, the built-in ssh

System Settings›General›Software Update

It only hits sshd on Linux built with musl libc and without PAM, like Alpine. On those systems some accounts accept any password between 256 and 1024 characters long. An sshd built with PAM support isn't hit by it. If you run sshd on Alpine, in a container or not, its fixed releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4.

Debian and Ubuntu patch their own packages and keep their own version numbers, so after an apt update the version may still read lower than the fixed one. Check your distribution's security notice for the package version that has the fix.

Sources