sshhole: OpenSSH Flaw on musl Linux Lets Long Passwords In
A critical OpenSSH bug dubbed sshhole, present since 2016 on musl-based Linux such as Alpine, accepts any password over 256 characters for passwordless accounts.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesA critical vulnerability named sshhole has been disclosed in OpenSSH on Linux systems that use the musl C library. The flaw has existed since 2016 and allows access to accounts that are not protected by a password. It affects distributions and tools such as Alpine, OpenWrt, Buildroot and Yocto, as well as many Docker images.
How the bug works
Accounts that are not meant to require a password, with * set in the password field, begin accepting any password longer than 256 characters. Typical examples are root, a deployment user that relies only on SSH keys, users managed through LDAP, and the default user in Alpine images for AWS and Azure. According to the disclosure, any password between 257 and 1024 characters is accepted for such an account.
A system is exposed only if several conditions are met at once: sshd runs on a musl-based system, PAM is not in use, password login is allowed (the default), and an account with * as its password exists. The system must also contain another account with a real password. Alpine's openssh-server package is configured without PAM by default, and some administrators also set UsePAM no explicitly.
Who is affected
The risk is highest in the official Alpine images for AWS and Azure. Their default user, alpine, has the setting described above and can run commands through doas without a password, which effectively gives root privileges.
Systems running Debian, Ubuntu, Fedora or any other glibc-based distribution are not affected. The same goes for setups with PAM configured, and for dropbear or the OpenBSD implementation of OpenSSH.
Fix
The problem is fixed in OpenSSH 10.6p2. Administrators of musl-based systems, particularly cloud instances and container images built on Alpine, should check their configuration and update. Disabling password authentication is another way to close off this attack path where it is not needed.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
ApplyNow Breach Exposes Data of 396,920 People in Japan
Chrome 157 Fixes 213 Security Flaws, Including 7 Critical Ones
Claude Code Background Subagents Now Use Less Usage Limit
