Search
The OpenSSH project has released an emergency update, version 10.6p2, to address a vulnerability that can bypass SSH authentication. After connecting to the target SSH port, an attacker does not need the actual password; they only need to know a passwordless account name and submit a long password of 257 to 1024 bytes to log in. Exploiting this vulnerability requires specific conditions, and its root cause lies in an abnormal interaction between sshd and the musl library's crypt() function, which may have existed since 2016. Systems based on musl, such as Alpine Linux, are affected. Alpine has already released a fix package and provided upgrade and temporary mitigation solutions. Currently, there are no reports of related attacks, and the vulnerability has not yet been assigned a CVE number.
-
C114 Communication Network -
Communication Home
