Alpine OpenSSH Flaw Can Bypass Password Checks on Exposed Servers

A flaw in Alpine Linux’s OpenSSH server can let an attacker bypass password checks on exposed systems, putting crypto infrastructure running affected builds at risk when specific account and configuration conditions are met.

The issue affects openssh-server builds without PAM. Exploitation requires a reachable SSH port, PasswordAuthentication enabled, a target account whose password field is *, and another local account with a $5$ or $6$ password hash. An attacker can then submit an exceptionally long password for the account marked * and authenticate in a single connection.

Alpine versions 3.21 through 3.24 and edge are affected, as are unsupported 3.16 through 3.20 releases. Systems using openssh-server-pam with UsePAM yes, or with password authentication turned off, are not affected.

Alpine’s official tiny-cloud image has an alpine account with a * password and password-free doas access. If the machine also has a $6$-hashed account, the flaw can create a path to root privileges.

OpenSSH 10.6p2 and patched packages for Alpine’s stable branches contain the fix. Administrators should upgrade with apk and restart sshd, because installing the package alone leaves the running daemon unchanged. If an upgrade cannot be applied, password authentication should be disabled.