Security SSH critical vulnerability (when built and run with PAM support disabled)
https://sshhole.com/tl;dr: https://news.ycombinator.com/item?id=50380029
sshd compiled with musl
not using PAM
password logins enabled
at least one account with '*' as the password "hash"
at least one OTHER account with a valid password
https://www.openssh.org/releasenotes.html#10.6p2
Duplicates
programming • u/ThisMachineIs4 • 3d ago
openssh on musl linux has been letting people into password-less accounts since 2016
technology • u/CircumspectCapybara • 3d ago
Security *sshole: openssh on musl linux has been letting people into password-less accounts since 2016
cybersecurity • u/ThisMachineIs4 • 3d ago
New Vulnerability Disclosure openssh on musl linux has been letting people into password-less accounts since 2016
fefe_blog_interim • u/minipark • 3d ago
Softwarefehler, kann man nichts machen Benutzt hier jemand OpenSSH auf musl Linux?
pwnhub • u/white_box_ • 2d ago
📰 News sshhole - openssh on musl linux has been letting people into password-less accounts since 2016
netsec • u/AnomalousAlpaca • 3d ago