sshole (sshhole.com)

Article summary

A vulnerability in OpenSSH on musl Linux, such as Alpine, allows accounts with no password set to accept any password longer than 256 characters. This issue has been present since 2016 and affects systems not using PAM. The vulnerability can be exploited to gain unauthorized access to affected systems. A fix is available in OpenSSH 10.6p2.

Main themes

• OpenSSH vulnerability
• musl Linux
• password authentication
• security exploit
• Docker containers

What commenters say

• The vulnerability is a significant issue that can be easily exploited, particularly in Docker containers running Alpine Linux.
• Many Docker containers may be exposed to this vulnerability, but it's unclear how many are actually running sshd under the affected conditions.
• The creative presentation of the vulnerability, including the website and name, is appreciated by some but seen as unprofessional by others.
• The use of lowercase writing and trendy language in the vulnerability disclosure is criticized for being unprofessional and distracting from the technical content.
• Some argue that musl's decision to return a single character instead of NULL was unnecessary and accommodates bad implementations.
• The vulnerability highlights the importance of building custom Docker images from scratch to avoid relying on potentially vulnerable base images.
• The exploit is considered catastrophic for those who are exposed, but it's estimated that relatively few people are actually running sshd under the affected conditions.