CVSS 8.1 (HIGH) · Actively exploited (listed in CISA KEV) · Affects: OpenSSH
OpenSSH versions prior to 10.6p2 on Linux systems using musl libc without PAM contain a critical authentication bypass flaw. Attackers can exploit this by submitting passwords between 256 and 1024 characters to gain unauthorized access.
Successful exploitation allows remote attackers to bypass password authentication, leading to full system compromise and data loss.
Upgrade OpenSSH to version 10.6p2 or later immediately. If upgrading is not possible, ensure PAM is enabled or migrate away from musl libc configurations.
在沒有 PAM 的 musl libc Linux 系統上，OpenSSH 10.6p2 之前的版本存在嚴重的身份驗證繞過漏洞。攻擊者可透過提交 256 至 1024 個字元的密碼來獲取未經授權的訪問權限。
請立即將 OpenSSH 升級至 10.6p2 或更高版本。若無法升級，請確保啟用 PAM 或遷移離 musl libc 配置。