A recently revealed vulnerability, designated "*sshole," presents a significant security risk, having resided within the codebase for ten years. This flaw is associated with OpenSSH and musl, enabling threat actors to gain access to specific Linux accounts running Alpine Linux or other systems utilizing musl. The condition for successful intrusion is that the target accounts must have password authentication disabled, and the attacker must supply a password exceeding 256 bytes, which is defined as "Oversized."
This critical issue highlights persistent security exposures within widely deployed infrastructure components. Market participants and institutions relying on musl-based Linux distributions must assess the implications of this vulnerability.
Why it matters
This vulnerability presents a significant remote access risk for operators running musl-based systems like Alpine Linux. Immediate patching is critical to prevent unauthorized logins through this decade-old code flaw.
