BlockBeats report, November 6: According to the official Alpine Linux security advisory, a password authentication bypass exists in the openssh-server package when built without PAM enabled: an attacker who can connect to the SSH port may, under specific conditions, log in successfully in a single connection without providing the correct password. These conditions include: PasswordAuthentication being enabled, the existence of an account with a password field set to *, and at least one other local account using a $5$ or $6$ hash; the attacker can successfully authenticate by submitting an excessively long password to the account without a password. Affected versions include officially verified Alpine 3.21–3.24 and edge, as well as end-of-life versions 3.16–3.20. Systems using openssh-server-pam with UsePAM yes, or those with password login disabled, are unaffected.
No CVE has been assigned as of publication. The official statement attributes the root cause to borrowing salt values from other accounts when PAM is disabled, and musl’s crypt() function returning * for excessively long passwords; patches have been released for OpenSSH 10.6p2 and all stable branches. It is recommended to immediately run 'apk upgrade' and restart sshd, as upgrading the package alone will not replace the running daemon; if upgrading is not currently possible, disable password authentication. In the official tiny-cloud image, the alpine user has a * password and can perform doas without a password; once a $6$ hash appears on the local system, it may be exploited to gain root access.