#crypt

OpenSSH 10.6p2, released Nov. 5, fixes a flaw in which crypt\(3\)&\x27;s treatment of special password-hash values as in-band signals let 257- to 1,024-byte passwords bypass SSH authentication on Alpine Linux, potentially logging an attacker into passwordless key-based accounts if they already have network access and a valid account name. Alpine has published fixed packages for 3.16 and newer, and administrators who cannot upgrade immediately can set PasswordAuthentication no to disable password logins. No exploitation has been reported.