Post · Fedizen

@GossiTheDog@cyberplace.social 3 hr. ago

OpenSSH has a vuln which allows logging in without a password. A thread.

https://www.openssh.org/releasenotes.html

It only impacts Linux distributions which ship with musl libc and PAM disabled. I think that is just Alpine Linux (all versions) and Void Linux.

It doesn’t impact Debian, Ubuntu, SUSE, Redhat or CentOS. Nor OpenWrt.

OpenSSH: Release Notes

OpenSSH release notes

9 Boosts

0 Likes

Leah Neukirchen

@leah@blahaj.social 14 min. ago

@GossiTheDog Void Linux uses PAM by default.

@GossiTheDog@cyberplace.social 3 hr. ago

This is the technical change to fix https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482

avoid password authn bypass · openssh/openssh-portable@4353fdc

This bypass affects some configurations and runtime configurations. We do not consider the root cause to be within OpenSSH but we are well equipped to avoid it.

@GossiTheDog@cyberplace.social 3 hr. ago

This is the mitigation for Alpine Linux https://fosstodon.org/@alpinelinux/117563196640515820