Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password

The internet continues to face security challenges after recent PHP vulnerabilities, with a new critical flaw affecting multiple Linux distributions. Attackers can gain access to Alpine Linux, OpenWRT, and others by simply entering any password exceeding 256 characters at the login prompt.

This vulnerability exists when system users have empty passwords, which is the default configuration on several distributions. The bug affects systems using Buildroot, Yocto, and Void Linux, with OpenWRT using Dropbear by default but allowing OpenSSH installation.

Emergency patches for OpenSSH and musl libc have been released to address the security issue that impacts millions of systems worldwide. System administrators are urged to apply these updates immediately to prevent unauthorized access.

Security Response

The vulnerability has been described as particularly concerning due to its simplicity and the widespread use of affected components in embedded systems and servers. Security researchers emphasize the importance of timely patching to mitigate potential breaches.