TL;DR

what: OpenSSH disclosed a critical flaw where sshd built without PAM on musl-based systems like Alpine Linux accepts any password of 257 to 1,024 bytes for accounts that have no password set.

impact: An attacker with network access and one valid username can log in to key-only, directory-sourced or default cloud accounts, and on tiny-cloud images from 3.18.11 through 3.24.3 can escalate to root through passwordless doas.

fix: OpenSSH 10.6p2 fixes the flaw, Alpine point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 ship the fixed package with backports to 3.16, and the vendor mitigation is disabling password authentication.

who: Alpine Linux servers and other musl-based systems (OpenWrt with OpenSSH installed, Buildroot, Yocto) running sshd without PAM with password logins enabled and at least one account holding a $5$ or $6$ hash.

An attacker who can reach an exposed Alpine Linux server over SSH and knows one account name can log in without credentials.…