Multiple outlets report that a newly disclosed OpenSSH vulnerability, dubbed “*sshole,” can allow attackers to log into certain Linux accounts that are configured to block password authentication. The issue affects some systems using the musl C library, with reporting specifically mentioning Alpine and other musl-based distributions. Attackers reportedly need network access, an account name, and a password longer than a certain limit.
The underlying cause, as described across sources, involves how OpenSSH handles password verification for accounts that have no usable password hash. Accounts that block password logins may have their password hash set to an asterisk (*) in /etc/shadow; the vulnerability is triggered when an oversized password interacts with musl’s crypt() behavior so that the comparison can succeed. Ars Technica highlights affected Alpine configurations, while Slashdot and BleepingComputer provide the most detailed technical context about the musl crypt() return value and how it relates to OpenSSH changes.
OpenSSH is also described as releasing an emergency fix, and some outlets note distribution updates for affected systems. Where details appear, there are differences in emphasis: Hacker News foregrounds the emergency fix and the approximate password length range, while other outlets focus more on the authentication-bypass mechanism and mitigations.
