🚨 A vulnerability that lived for 10 years: Enter a password 257 to 1024 bytes long, and you could log in to someone else’s server
Group: 邀请您加入我的群组 悟空粉丝群
On November 5, OpenSSH and Alpine Linux released a fix. The next day, Changpeng Zhao warned system administrators on X: "This OpenSSH vulnerability in Alpine Linux has been around for 10 years. If you haven't patched it, do so now."
He also clarified that this did not mean Binance had ever been compromised by this vulnerability.
📊 The technical chain is more worth examining: Researchers found that in musl libc, used by Alpine, the hash function returns an asterisk when a password exceeds the 256-byte limit. Meanwhile, when OpenSSH checks an account with "no password," it borrows the salt from another local account.
Each behavior is reasonable on its own, but together they cause a problem: The returned asterisk matches the asterisk used for an "empty password field," allowing authentication with a single connection—no repeated password attempts needed.
🔸 The requirements are neither especially strict nor universal: You need to be running OpenSSH without PAM enabled, have password authentication turned on, know the username whose password field is an asterisk, and have another account on the machine with a SHA-256 or SHA-512 hash. Systems using PAM, with password login disabled, or not running SSH in their containers are not affected.
💡 What really deserves attention isn't "another vulnerability," but how it happened: It wasn't a mistake in a single line of code; rather, the reasonable default behaviors of two components collided at an edge case. The musl limit came from changes made between 2012 and 2016, while OpenSSH's use of another account's salt was added in July 2016 to fix a different issue. Both sides were fixed correctly, but together they created a bypass.
⚠️ The scope goes beyond Alpine: Other distributions using musl libc, including some OpenWrt, Buildroot, and Yocto configurations, are also affected. OpenWrt uses Dropbear by default and is not affected.
📌 If you run a node, validator, or self-hosted service, there's just one thing to check this week: Make sure your server is running a patched version of OpenSSH.
Who's in charge of patches on your server?
Tap my profile picture to watch the livestream + join my fan group for daily strategies 🚀
#公链 #DeFi
Group: 邀请您加入我的群组 悟空粉丝群
On November 5, OpenSSH and Alpine Linux released a fix. The next day, Changpeng Zhao warned system administrators on X: "This OpenSSH vulnerability in Alpine Linux has been around for 10 years. If you haven't patched it, do so now."
He also clarified that this did not mean Binance had ever been compromised by this vulnerability.
📊 The technical chain is more worth examining: Researchers found that in musl libc, used by Alpine, the hash function returns an asterisk when a password exceeds the 256-byte limit. Meanwhile, when OpenSSH checks an account with "no password," it borrows the salt from another local account.
Each behavior is reasonable on its own, but together they cause a problem: The returned asterisk matches the asterisk used for an "empty password field," allowing authentication with a single connection—no repeated password attempts needed.
🔸 The requirements are neither especially strict nor universal: You need to be running OpenSSH without PAM enabled, have password authentication turned on, know the username whose password field is an asterisk, and have another account on the machine with a SHA-256 or SHA-512 hash. Systems using PAM, with password login disabled, or not running SSH in their containers are not affected.
💡 What really deserves attention isn't "another vulnerability," but how it happened: It wasn't a mistake in a single line of code; rather, the reasonable default behaviors of two components collided at an edge case. The musl limit came from changes made between 2012 and 2016, while OpenSSH's use of another account's salt was added in July 2016 to fix a different issue. Both sides were fixed correctly, but together they created a bypass.
⚠️ The scope goes beyond Alpine: Other distributions using musl libc, including some OpenWrt, Buildroot, and Yocto configurations, are also affected. OpenWrt uses Dropbear by default and is not affected.
📌 If you run a node, validator, or self-hosted service, there's just one thing to check this week: Make sure your server is running a patched version of OpenSSH.
Who's in charge of patches on your server?
Tap my profile picture to watch the livestream + join my fan group for daily strategies 🚀
#公链 #DeFi
