OpenSSH 10.6p2

OpenSSH Releases Patch for Critical Authentication Bypass Affecting musl-Based Linux Distributions

OpenSSH has issued version 10.6p2 containing a mitigation for a critical vulnerability nicknamed '*sshole' that allows authentication bypass on systems using the musl C library. The flaw affects distributions including Alpine Linux, OpenWRT, Buildroot and Yocto where sshd runs without PAM and password authentication remains enabled. Attackers can log into accounts configured with a single asterisk as the password hash by supplying any password longer than 256 characters. Researcher Özgün Kültekin discovered the issue, which stems from legacy Unix password handling practices still present in modern images such as official AWS and Azure Alpine Linux builds. OpenSSH developer Damien Miller stated the root cause lies outside the project yet OpenSSH is well positioned to mitigate it, prompting an expedited release to prevent discovery by AI agents. Alpine Linux urges users running sshd to update immediately and restart the daemon, or disable password authentication if patching is not yet possible.