<p><a href="https://openssh.com/releasenotes.html#10.6p2">Version 10.6p2</a> of OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use <a href="https://musl.libc.org/">musl libc</a> with PAM disabled, such as <a href="https://www.alpinelinux.org/">Alpine Linux</a>. OpenSSH developer Damien Miller <a href="https://hachyderm.io/@damienmiller/117563026759098135">said</a>:</p> <blockquote class="bq"> <p>If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set <tt>PasswordAuthentication=no</tt> or disable SSH for these systems IMMEDIATELY.</p> <p>This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.</p> <p>We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.</p> </blockquote> <p>The Alpine Linux project has <a href="https://fosstodon.org/@alpinelinux/117563196640515820">announced</a> that it will be backporting the OpenSSH fix "<q>all the way back to Alpine 3.16</q>", which was <a href="https://alpinelinux.org/posts/alpine-3.16.0-released/">released</a> in May 2022.</p>
Continue to LWN.net →You are being forwarded in 6s — stay on this page