Critical security vulnerability affects OpenSSH on Alpine Linux systems

Version 10.6p2 ofOpenSSH has been released with a workaround for a critical vulnerability thataffects Linux systems that use musl libcwith PAM disabled, such as AlpineLinux. OpenSSH developer Damien Miller said:

If you operate a Linux system that uses musl libc without PAM (Alpine Linuxis one example) then stop reading and set PasswordAuthentication=no or disableSSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systemsand Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, butwe're in a good position to deliver a mitigation quickly.

The Alpine Linux project has announced thatit will be backporting the OpenSSH fix "all the way back to Alpine 3.16",which was released in May2022.