What happened
OpenSSH disclosed a critical authentication bypass flaw that affects the `openssh-server` package shipped with Alpine Linux. An attacker who can reach the SSH service, knows a valid account name, and supplies a password between 257 bytes and 1 024 bytes can log in to accounts that have no password (e.g., key‑only accounts). The bug stems from improper handling of unusually long password buffers, allowing the authentication routine to skip password verification entirely. OpenSSH released version 10.6p2 as an emergency fix, and Alpine Linux has published patched packages for all supported releases.
Why it matters for trust and compliance
- The flaw challenges the access‑control objective of guaranteeing that only authorized identities can obtain system access, a core control across most governance frameworks.
- Demonstrates the need for continuous monitoring of authentication mechanisms and evidence of patch compliance.
- Supports audit readiness by mapping the fix to access‑control policies and control‑objective evidence.
Who is affected
CLOUD_INFRA TECH_SAAS
Recommended actions
- Upgrade OpenSSH to version 10.6p2 or later on all Alpine Linux hosts.
- Validate package versions through automated inventory tools.
- Enforce password‑length restrictions that reject passwords >256 bytes.
- Enable detailed SSH logging and review for anomalous login attempts.