On Thu, 5 Nov 2026 at 23:14, Jan Schaumann <[email protected]> wrote:
>
> OpenSSH just published OpenSSH 10.6p2 with a critical
> fix for a password authentication bypass on systems
> that use musl libc and have PAM disabled. Alpine
> Linux has been called out as one such affected
> system:
>
> https://www.openssh.org/releasenotes.html#10.6p2
>
> > * sshd(8): avoid password authentication bypass
> > that is exploitable through sshd(8) that affects
> > some Linux systems when built and run with PAM
> > support disabled. We consider the root cause of
> > this bug to be outside sshd, but it is exploitable
> > via sshd and can be avoided there.
> >
> > This bug was reported by Özgün Kültekin of
> > Wakefield (wakefield.co)
>
>
> The vulnerability itself is described here:
>
> https://sshhole.com/
It's unfortunate that some people are writing misleading statements
about a security
problem in OpenSSH, especially on linkedin, despite djm@ explaining
that this is a WORKAROUND.
