Attackers can log in to some Alpine Linux servers without a valid password, according to a report from The Hacker News. The flaw affects accounts that have no password, such as SSH key-only accounts, on servers running the standard openssh-server package.
To exploit the flaw, an attacker needs network access to the server, an account name, and a password between 257 and 1,024 bytes long.
OpenSSH rates the flaw critical. The project released version 10.6p2 to block it. Alpine has published fixed packages for every affected release, the report says.