Choose Rich Live
Tech

Emergency patches rolled out for decade-old OpenSSH and musl flaw dubbed SSHole

Security teams have issued emergency fixes after researchers uncovered a decade-old authentication bypass vulnerability in OpenSSH and musl-libc that allows unauthorized logins using passwords over 256 characters.

Maintainers of OpenSSH, musl-libc, and Alpine Linux have rushed out emergency security updates to address a severe authentication bypass flaw dubbed "*sshole" or "SSHole." The decade-old vulnerability stems from combined weaknesses in OpenSSH and the musl standard C library, which allow unauthorized access to affected systems when an attacker submits an arbitrary password exceeding 256 characters.[1][3][4][5][6]

According to reporting by BleepingComputer's Lawrence Abrams, the issue enables attackers to log into passwordless accounts on certain musl-based Linux distributions. Tom's Hardware reported that millions of systems are affected across Alpine Linux and other distributions, urging administrators to apply patches immediately. ZDNET characterized the issue as being "as bad as it can get."[1][2][3][5]

The disclosure also drew warnings outside the traditional Linux community. Prominent cryptocurrency figure Changpeng Zhao publicly alerted users to the decade-old vulnerability on Alpine Linux, advising system operators to patch without delay.[7]

Key facts

  • A combined flaw in OpenSSH and musl-libc allows attackers to bypass authentication using any password exceeding 256 characters.
  • The vulnerability, dubbed "*sshole" or "SSHole," has reportedly existed for a decade.
  • BleepingComputer reported that the flaw enables logins to passwordless accounts on certain musl Linux systems, such as Alpine Linux.
  • Emergency patches were issued for OpenSSH, musl-libc, and Alpine Linux, affecting millions of systems.
  • Changpeng Zhao warned users about the vulnerability and urged immediate deployment of security patches.

Sources · 6 sources

  1. TE

    TechmemeArticle ·

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer) Lawrence Abrams / BleepingComputer : Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems — A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux …

    Open source
  2. TE

    Techmeme@TechmemePost on X ·

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (@lawrenceabrams / BleepingComputer) (Visit Techmeme dot com for the link and full context!)

    Open source
  3. ZD

    ZDNET@ZDNETPost on X ·

    Alpine Linux and OpenSSH patch flaw that's as bad as it can get - ZDNET https://t.co/dPYCydacG7

    Open source
  4. SE

    SecurityWeek@SecurityWeekPost on X ·

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass https://t.co/voq3xw55UB

    Open source
  5. TH

    Tom's Hardware@tomshardwarePost on X ·

    Combined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately https://t.co/1sELx1BeZC

    Open source
  6. SE

    SecurityWeek@SecurityWeekPost on X ·

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass https://t.co/voq3xw5DK9

    Open source
  7. CO

    Cointelegraph@CointelegraphPost on X ·

    🚨 UPDATE: CZ warns of a decade-old OpenSSH vulnerability in Alpine Linux and urges users to apply the security patch. https://t.co/EI8UKHiURP

    Open source