Alpine Linux has revealed a critical passwordless SSH login flaw in its OpenSSH implementation, which allows unauthorized access without a known password, and users are urged to upgrade and restart the daemon to resolve this issue. Debian and Ubuntu have fixed a shared APT vulnerability that could allow man-in-the-middle attacks to execute arbitrary code as root, with patches available across multiple releases, including older versions. Additionally, Fedora has addressed multiple vulnerabilities, including a significant update for Python, while Red Hat, Oracle, and Rocky Linux have rolled out security patches across various packages, with a focus on critical issues related to fence-agents and webkit2gtk3. Overall, users across different Linux distributions are advised to apply these patches promptly to enhance security and address the identified vulnerabilities

Linux Security Roundup: Alpine SSH Flaw and Shared APT Bug

Alpine Linux disclosed a passwordless SSH login flaw with no CVE yet, working in a single connection when OpenSSH runs without PAM. Debian and Ubuntu both fixed a shared APT vulnerability that lets a man-in-the-middle swap verified packages and get arbitrary root code execution, with Ubuntu backing all the way to 14.04 LTS. Fedora's batch centers on the still-lingering eMudhra CA distrust plus a Python update bundling four interpreter versions, while fence-agents Criticals and 145-CVE Firefox pushes show up across RHEL, Oracle, Rocky, and AlmaLinux. The practical advice: patch Alpine sshd and restart the daemon, grab the APT fix even on old releases, and pull Fedora's Python update first.

Linux Security Roundup: Alpine SSH Flaw and Shared APT Bug @ Linux Compatible