sshole OpenSSH flaw with musl allows logins

Tier A · Patch today – Before you go home

Who’s exposed: Alpine and other musl-based Linux accounts with password auth blocked

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Remote, no login · Full takeover

The Brief

A newly disclosed OpenSSH flaw involving musl, dubbed "*sshole", affects Alpine Linux and other musl-based systems.
Attackers can log in to accounts configured to block password authentication by exploiting the flaw.
According to Schneier on Security, the flaw has been in the code for about a decade.

Why it matters

If you run OpenSSH on Alpine or another musl-based Linux, accounts you have locked to key-only or no-password login may not be as protected as you expect.

The checklist behind the tier

Checklist · 5 of 10 yes

Yes	Hits tech teams	Judgment: OpenSSH on Alpine and other musl Linux servers is run by developers and ops teams.
Yes	Core infrastructure	Judgment: OpenSSH is core infrastructure nearly every team runs for remote server access.
Yes	Popular tool	Judgment: OpenSSH is a widely used, mainstream tool; it is core infrastructure.
No	Exploited in the wild	Schneier on Security reports only a newly disclosed flaw, with no observed attacks mentioned.
No	Public exploit	Schneier on Security reports the flaw is disclosed but does not say exploit code is published.
Yes	Remote, no login	Schneier on Security: attackers can log in simply by entering an (truncated) value, implying no credentials needed over the network.
Yes	Full takeover	Schneier on Security: attackers can log in to affected accounts, which amounts to account takeover.
No	Secrets exposed	Schneier on Security reports login access but no stolen credentials, keys, configs or data.
No	Supply chain	Schneier on Security describes a normal vulnerability in legitimate code, not malicious shipped code.
No	No fix yet	Schneier on Security does not state whether a patched version is available; no fix is reported.

Source

New OpenSSH Vulnerability ↗ Schneier on Security · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided