AI Weekly Malaysia

Alpine Linux published an advisory for an OpenSSH-server password authentication bypass: an attacker who can reach the SSH port can log in without a password by sending a 257–1024 byte password, provided the target account has a * password field and at least one account on the host has a $5$ or $6$ hash. It affects Alpine 3.16 through 3.24 and edge when openssh-server is built without PAM or openssh-server-pam uses UsePAM no, and PasswordAuthentication is yes. Fixed packages are in Alpine 3.21.10, 3.22.8, 3.23.8, and 3.24.4; upgrading alone does not replace the running daemon.

Why: If you run sshd on Alpine with the default PasswordAuthentication yes, any key-only account — root:* in the base image or a user created without a password — can become a login path for an attacker, so you need to restart sshd after apk upgrade or set PasswordAuthentication no and restart. The operational trap is that apk upgrade -U -a alone leaves the old daemon running.

The Hacker News headline reports that OpenSSH shipped an emergency fix for a flaw that lets unusually long passwords bypass SSH authentication specifically on Alpine Linux. Beyond the title, the supplied page text is almost entirely site navigation and boilerplate, so there are no affected version numbers, CVE identifier, patch release name, or exploit conditions to work from.

Why: Concretely, the one actionable fact is narrow: if you run SSH on Alpine Linux (common as a base image for small containers), an over-long password can reportedly authenticate without the correct credential, so patching OpenSSH on Alpine hosts is the specific action. Because the text gives no version range, no CVE, and no confirmation of whether the default Alpine sshd config is exposed, you cannot yet judge your own exposure from this item alone — check the actual advisory before assuming you are or aren't affected.