OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
OpenSSH releases emergency fix for critical flaw allowing long passwords to bypass SSH auth on Alpine Linux.
A critical vulnerability in OpenSSH, rated as such by the OpenSSH project itself, allowed attackers to bypass SSH authentication on certain Alpine Linux servers. The flaw enabled logins to accounts without passwords, including SSH key-only accounts, provided the attacker had network access, an account name, and a specially crafted password between 257 and 1,024 bytes long. OpenSSH has released version 10.6p2 to address this issue, and Alpine Linux has published updated packages.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenSSH?
Get an email when a new story names OpenSSH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical flaw in OpenSSH allowed attackers to completely bypass SSH authentication on Alpine Linux systems, including accounts configured for key-only access, simply by supplying a specially crafted long password. This means that even security-hardened configurations — where passwords should not matter — were rendered ineffective by a single unpatched vulnerability. The root cause lies in inadequate patch management practices; organizations running affected versions of OpenSSH on Alpine Linux were exposed until they applied the emergency fix in version 10.6p2. This incident underscores how a single unpatched component in a widely-used remote access tool can nullify multiple layers of security controls, making timely patching of internet-facing services non-negotiable.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.