Alpine Linux flaw permits SSH access under specific authentication settings

A decade-old vulnerability allows attackers to log into some Alpine Linux devices without knowing a password, Alpine maintainers warned Thursday. Exploitation requires OpenSSH to use the musl library without the PAM authentication framework, alongside specific account settings. The system must have an active account with a SHA256 or SHA512 password hash, and the target account must have an asterisk in its password field. An attacker who can reach the SSH port can then enter more than 256 characters as a password to gain access. Checkpoint said default root login settings protect root accounts, but accessible accounts with sudo or doas privileges can still obtain root access.