Alpine Linux fixes OpenSSH flaw allowing passwordless logins

OpenSSH has released an emergency fix (version 10.6p2) to block a critical flaw that allowed logins to accounts with no password on Alpine Linux servers running the standard openssh-server package. Alpine’s openssh-server is built without PAM, and password logins are enabled by default, making the vulnerability exploitable under a specific combination of conditions. Damien Miller of the OpenSSH project described the issue, and Alpine’s advisory outlines four criteria that must be met for exposure. No attacks have been reported at the time of the advisory.

The flaw arises from how sshd validates passwords when PAM is not used and musl’s crypt() path permits long-password logins. An attacker would need network access, the target account name, and a password between 257 and 1,024 bytes. Alpine notes that accounts with no password can include key-only users, root in certain images, and other local or directory-service users, with the risk magnified if another account has a real password hash.

Remediation guidance from OpenSSH is to upgrade to 10.6p2; Alpine has fixed packages across releases back to 3.16, and point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 include the fix. If upgrading is not yet possible, disabling PasswordAuthentication or locking down SSH access are advised precautions.