sshhole
A musl/OpenSSH interaction can let an attacker log into certain passwordless accounts using a long arbitrary password when sshd runs without PAM. The affected configuration also needs password authentication enabled, a target with * as its password field, and another account with a SHA-256 or SHA-512 password hash.
Alpine recommends upgrading OpenSSH and restarting sshd; disabling password authentication and restarting also mitigates it. Default OpenSSH root-login restrictions matter, but other login-capable accounts may still be exposed. Alpine says its official tiny-cloud images can be affected.
HN commenters explain how musl’s crypt() error sentinel can equal the target’s shadow field after OpenSSH selects another account’s salt; they disagree about how common the required configuration is. Lobsters readers also note the default root restriction and criticize the disclosure’s presentation.