Hi there, This probably wouldn't rate a mention on this list except for the fact that there seems to be quite a few people using BackupPC under Docker, and AFAICT most of the Docker images use lightweight versions of Linux such as Alpine Linux.
A serious vulnerability in the implementation of openssh with the musl library (as opposed to the glibc library), together with certain setup configurations, results in it being trivial to log in remotely without valid credentials. At the moment there seems to be some debate about who takes the blame for this one but that really isn't important. As always, my advice is don't open any BackupPC server to the Internet but if you do currently have a BackupPC server that allows access from the Internet to port 22, then please ensure that it is not vulnerable. The same applies to any other box really. Routers are obvious targets as they often run Alpine Linux or a similar lightweight Linux distro. As yet I don't know of a CVE, there's a writeup on Ars Technica here: https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/ -- 73, Ged. _______________________________________________ BackupPC-users mailing list [email protected] List: https://lists.sourceforge.net/lists/listinfo/backuppc-users Wiki: https://github.com/backuppc/backuppc/wiki Project: https://backuppc.github.io/backuppc/
