OpenSSH 10.6p2 released
by from OpenBSD Journal on (#79HWN)
In an announcement posted on social media, Damien Miller (djm@) writes,
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.