As cited
Copy frozen at (site build).
vulnerabilities
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
A decade-old vulnerability in OpenSSH running on Alpine Linux with musl libc and without PAM enables password-free login to affected systems. The flaw requires specific conditions: at least one user account with a SHA256 or SHA512 password hash, and a target account configured as passwordless (marked with "*" in /etc/shadow). Attackers can exploit this configuration with a single connection attempt to gain unauthorized access.
Why it matters: Alpine Linux users and operators of other distributions using OpenSSH with musl and without PAM should audit whether their systems have passwordless accounts and SHA256/SHA512 hashed passwords in the same deployment, as this combination creates an unauthenticated remote access risk.
- Source published
- First seen by Cybersecurity Tracker