Alpine Discloses OpenSSH Authentication Bypass Vulnerability

Cointime update: Alpine Linux issued a security advisory on November 6 warning that some OpenSSH server configurations contain a password authentication bypass flaw, letting attackers log into accounts with no password set by submitting passwords of 257 to 1024 bytes. Affected servers must enable password authentication, run OpenSSH without PAM, and host both passwordless accounts and local accounts using specific password hashes. Alpine has released patched packages and advises updating OpenSSH and restarting sshd; Binance co-founder CZ urged users to apply the fix.