OpenSSH Releases Patch 10.6p2 to Fix Password-Based Login Vulnerability

Key summary

OpenSSH has released patch version 10.6p2 to address a security vulnerability that allows remote login using a password under specific conditions. This vulnerability occurs when the software is compiled using the musl library, which is commonly used in embedded Linux systems, and PAM is not enabled, and the target account does not have a password set. This configuration is similar to Alpine Linux, which is popular among Docker users. While Alpine is configured to have no root password and prevents login with a password, users may be affected if they create accounts without passwords and grant them doas privileges as root. Most users who use Alpine through Docker applications do not have SSH installed and are therefore not affected. However, those who are running servers or installing SSH in Docker should check their configurations promptly. References: Alpine Linux and OpenSSH.