Alpine Warns That OpenSSH Password Authentication Can Be Bypassed With A Single Click

According to Alpine Linux’s official security advisory, its openssh-server package has a password authentication bypass vulnerability in builds where PAM is not enabled. Attackers who can connect to the SSH port can log in in a single attempt without a correct password under specific conditions. The required conditions include: PasswordAuthentication is enabled, an account with a password field set to *, and at least one account on the local machine with a $5$ or $6$ hash. Attackers can submit an extremely long passphrase to a passwordless account to successfully authenticate. Affected versions cover Alpine 3.21–3.24 and edge (verified by the official), as well as end-of-life versions 3.16–3.20. Systems using openssh-server-pam with UsePAM set to yes, or those that have disabled password login, are not impacted. No CVE has been assigned as of press time. The official states the root cause is tied to two factors: borrowing salt values from other accounts when PAM is disabled, and musl’s crypt() function returning * for extremely long passphrases. OpenSSH 10.6p2 and patch packages for all stable branches have fixed the issue. Advisories recommend running `apk upgrade` immediately and restarting the sshd daemon, as upgrading only the package will not replace the running active daemon. If an upgrade is not immediately feasible, disable password authentication. Notably, the alpine user in the official tiny-cloud image has a password field set to * and allows passwordless doas access, which could be exploited to gain root privileges if a $6$ hash exists on the local machine.