Alpine Linux has released four updates (3.21.10, 3.22.8, 3.23.8, and 3.24.4) to address a critical vulnerability in OpenSSH that allows attackers to log in without a password under specific conditions. The flaw occurs when the SSH server runs without PAM, with password authentication enabled, and at least one account has a scrypt or SHA hash, making many default configurations vulnerable. Users are advised to upgrade their systems and restart the sshd daemon to mitigate the risk, as simply upgrading does not stop the vulnerable service from running. Additionally, a separate patch addresses a crash issue in apk-tools, the Alpine package manager, emphasizing the importance of keeping systems updated to avoid vulnerabilities
Alpine Linux 3.21.10, 3.22.8, 3.23.8 and 3.24.4 Patches Critical SSH Password Bypass
Alpine Linux released four coordinated point updates today, fixing a critical OpenSSH flaw that lets attackers log in without a password using just a single, unusually long login attempt. The bypass works when sshd runs without PAM, password authentication is enabled, and at least one account has a scrypt or SHA hash nearby, which covers a lot of default Alpine setups. Alpine shipped the fix via OpenSSH 10.6p2 while still patching the now-EOL 3.21 branch and backing all the way down to 3.16, alongside a separate apk-tools crash fix spanning both package-manager generations. If you run sshd, upgrade with apk upgrade -U -a and restart the daemon, since the running service keeps serving the vulnerable code until you do.
