[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Alpine Linux security advisory and OpenSSH 10.6p2 release notes, Nov 5); no CVE assigned yet

OpenSSH 10.6p2 fixes a password bypass on Alpine Linux: a 257-1024 byte password logs in to accounts that have no password set

  • Affected (per Alpine): the openssh-server package (built without PAM), or openssh-server-pam with UsePAM no; PasswordAuthentication yes (the default); an account whose password field is * (root ships as root:* since about 3.16, key-only users, directory users via musl-nscd, the alpine user in tiny-cloud images); and at least one local $5$/$6$ password hash. Root is protected only if PermitRootLogin stays at prohibit-password, and not if another reachable account can become root (e.g. via doas).
  • Not affected: containers that don't run sshd, PasswordAuthentication no (cloud-init images set this), UsePAM yes, accounts locked with !.
  • Fix: apk upgrade -U -a, then restart sshd (rc-service sshd restart); the package upgrade does not restart the running daemon. Fixed openssh builds: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, with fixes also for 3.16-3.20.
  • If you can't update: set PasswordAuthentication no and restart sshd (test key login in a second session first).

Other musl-based distributions that build OpenSSH without PAM should check with their maintainers.

Sources: Alpine Linux: Security advisory: openssh-server password authentication bypass (Nov 5) · OpenSSH 10.6p2 release notes (Nov 5)