Security · High impactFan score 67 · Tier A
New OpenSSH Vulnerability
Schneier on Security · By Bruce Schneier ·
The Brief
- A newly disclosed OpenSSH flaw involving musl, dubbed "*sshole", affects Alpine Linux and other musl-based systems.
- Attackers can log in to accounts configured to block password authentication by exploiting the flaw.
- According to Schneier on Security, the flaw has been in the code for about a decade.
Why it matters
If you run OpenSSH on Alpine or another musl-based Linux, accounts you have locked to key-only or no-password login may not be as protected as you expect.
Who’s affected
- Alpine Linux operators
- Teams running OpenSSH on musl-based Linux distributions
- #openssh
- #musl
- #alpine-linux
- #security
- #authentication
It’s a bad one , and it’s been in the code for a decade: A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an…