Version 10.6p2 of
OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use musl libc
with PAM disabled, such as Alpine
Linux. OpenSSH developer Damien Miller said:
If you operate a Linux system that uses musl libc without PAM (Alpine Linux
is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems
and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but
we're in a good position to deliver a mitigation quickly.
The Alpine Linux project has announced that
it will be backporting the OpenSSH fix "all the way back to Alpine 3.16",
which was released in May
2022.
https://lwn.net/Articles/1105464/
--- SBBSecho 3.38-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (86:200/23)