A vulnerability in Alpine Linux and potentially other distributions allows attackers to access devices via SSH without a password. This flaw is linked to the interaction between OpenSSH and musl, requiring specific configurations for exploitation. Affected systems must have user accounts with passwords hashed using SHA256 or SHA512 and configured as passwordless. This vulnerability highlights security risks associated with certain account settings commonly used for certificate-based authentication.
Key facts
- Vulnerability allows SSH access without a password on Alpine Linux.
- Affected systems must use OpenSSH with musl and not PAM.
- Requires user accounts with SHA256 or SHA512 hashed passwords.
- Passwordless accounts are configured with a '*' in /etc/shadow.
- Alpine Linux is a lightweight and widely used distribution.
A short AI summary in our own words. The reporting belongs to Ars Technica; we don't reproduce it.