From the Alpine advisory and the researcher’s notes: musl’s crypt() gives back * when a password is over 256 bytes, and sshd then compares it with an account whose stored field is also *. Key-only users have that field, and so does the alpine user on tiny-cloud images. Fix is OpenSSH 10.6p2 or Alpine’s backport (on 3.24 that’s 10.3_p1-r2), plus an sshd restart. PasswordAuthentication no also closes it. Package table and check commands are in the link. Disclosure: it’s our blog, we run a proxy service.
Somehow breathed a sigh of relief, finding out that I am not affected.
nice. the ones people tend to forget are alpine-based containers that run sshd inside. on alpine ssh -V won’t settle it, since the fix is a backport, so check the package with apk info openssh instead.
