A critical OpenSSH bug, nicknamed "sshole," lets attackers log into Alpine Linux and other musl-based systems that have password authentication disabled, simply by submitting an oversized password between 257 and 1,024 bytes. No prior credentials are needed beyond network access and a valid account name, making key-only SSH setups unexpectedly vulnerable. OpenSSH shipped version 10.6p2 and Alpine released patched packages to close the hole.
// source: thehackernews.com ↗