[Alpine Warns of One-Click Bypass for OpenSSH Password Authentication] BlockBeats reports on November 6th that, according to an official Alpine Linux security bulletin, its openssh-server package, when built without PAM enabled, contains a password authentication bypass vulnerability. Attackers, provided they can connect to the SSH port, can log in without a valid password under certain conditions. These conditions include enabling PasswordAuthentication, the existence of an account with a password field containing *, and at least one account on the local machine with a hash of $5 or $6. Attackers can also successfully match excessively long passwords submitted to passwordless accounts. The affected systems include Alpine versions 3.21–3.24 and edge (officially verified), as well as the discontinued versions 3.16–3.20. Systems using openssh-server-pam with UsePAM enabled (yes) or with password login disabled are not affected. As of press time, no CVE has been assigned. The official explanation states that the root cause is related to borrowing salt values from other accounts when PAM is not enabled, and musl's crypt() returning * for excessively long passwords; this has been fixed in OpenSSH 10.6p2 and various stable branch patches. It is recommended to immediately upgrade the APK and restart sshd; upgrading the package alone will not replace the running daemon. If upgrading is not currently possible, password authentication should be disabled. The alpine user in the official tiny-cloud mirror carries a * password and can perform passwordless doas; if a $6$ hash appears on the local machine, it could be exploited to gain root access. [Original Link]