OpenSSH flaw bypasses password-disabled accounts on musl-based Linux

A newly disclosed OpenSSH vulnerability, dubbed '*sshole', allows attackers to log into Alpine Linux and other musl-based systems even when password authentication is disabled, by submitting an oversized password. The flaw stems from a memory corruption issue in the musl libc's password handling, potentially enabling unauthorized access. This is a significant authentication bypass affecting a niche but security-sensitive user base, with no patch yet confirmed.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works