Critical security vulnerability affects OpenSSH on Alpine Linux systems

Date:
Thu, 05 Nov 2026 11:39:10 +0000

Description:
Version 10.6p2 of
OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use musl libc with PAM disabled, such as Alpine Linux . OpenSSH developer Damien Miller said : If you operate a Linux system that uses musl libc without PAM (Alpine Linux
is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY. This vulnerability does not exist on non-Linux systems, Linux/glibc systems
and Linux systems that use PAM for password authentication. We consider the root cause of this bug to be outside OpenSSH itself, but
we're in a good position to deliver a mitigation quickly. The Alpine Linux project has announced that
it will be backporting the OpenSSH fix " all the way back to Alpine 3.16 ", which was released in May
2022.

======================================================================
Link to news story:
https://lwn.net/Articles/1105464/


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet UK HUB @ hub.uk.erb.pw (1337:1/100)