【CZ Reminder】Binance founder CZ posted on X today, reminding server operators to fix as soon as possible an OpenSSH security vulnerability that has existed for nearly 10 years: an authentication bypass vulnerability in OpenSSH on Alpine Linux systems. Attackers may be able to access some accounts without a password, even if those accounts are configured to allow SSH key-based login only.
OpenSSH released version 10.6p2 with a fix on November 5, and Alpine Linux also released a security patch. The vulnerability was discovered by security researcher Özgün Kültekin and dubbed “sshole.” It can be traced back to changes made between 2012 and 2016.
CZ's exact words: “Alpine Linux OpenSSH security bug that's been there for 10 years. Apply the fixes if you haven't.” (Translation: The OpenSSH security vulnerability in Alpine Linux has been around for 10 years. If you haven't fixed it yet, please do so as soon as possible.)
Source: crypto.news, November 6.
OpenSSH released version 10.6p2 with a fix on November 5, and Alpine Linux also released a security patch. The vulnerability was discovered by security researcher Özgün Kültekin and dubbed “sshole.” It can be traced back to changes made between 2012 and 2016.
CZ's exact words: “Alpine Linux OpenSSH security bug that's been there for 10 years. Apply the fixes if you haven't.” (Translation: The OpenSSH security vulnerability in Alpine Linux has been around for 10 years. If you haven't fixed it yet, please do so as soon as possible.)
Source: crypto.news, November 6.