As cited
Copy frozen at (site build).
vulnerabilities
Get root on a musl Linux system by slamming it with an overly long password
A vulnerability in OpenSSH on musl libc-based Linux systems allows attackers to gain root access by supplying passwords longer than 256 bytes to accounts marked with an asterisk in the password field. The flaw, dating to 2016, affects systems without Pluggable Authentication Modules (PAM) and with password authentication enabled, and is particularly relevant for Alpine Linux deployments on AWS and Azure. OpenSSH 10.6p2 and newer versions include a fix, or administrators can disable password authentication as a workaround.
Why it matters: Alpine Linux users on cloud platforms and operators of musl-based embedded systems must verify their OpenSSH version and configuration, as vulnerable setups could allow unauthorized root access without detection.
- Source published
- First seen by Cybersecurity Tracker