Alpine Linux discloses OpenSSH authentication bypass vulnerability, fix released

Alpine Linux disclosed a password-authentication bypass in OpenSSH servers under certain configurations, where an attacker who knows a target account name can log into accounts with no password set by submitting a password between 257 and 1,024 bytes long. The flaw requires password authentication to be enabled, a non-PAM OpenSSH configuration, and the coexistence of passwordless accounts with local accounts using specific password hashes. Alpine has released fixed packages and advises users to update OpenSSH and restart sshd, or disable password authentication and restart the service if patching is not immediately possible. The issue matters because OpenSSH underpins remote access on a vast share of Linux infrastructure, and Alpine-based container images are widely used in production and CI environments. Binance co-founder CZ amplified the advisory to users. What to watch next is uptake of the patched packages and whether downstream distributions and container image maintainers rebuild against the fix.