Alpine OpenSSH Flaw Can Bypass Password Checks on Exposed Servers

A flaw in Alpine Linux’s OpenSSH server can let an attacker bypass password checks on exposed systems, putting crypto infrastructure running affected builds at risk when specific account and configuration conditions are met. The issue affects openssh-server builds without PAM. Exploitation requires a reachable SSH port, PasswordAuthentication enabled, a target account whose password field is *, and another local account with a $5$ or $6$ password hash. An attacker can then submit an exceptionally long password for the account marked * and authenticate in a single connection.

Source: TokenPost