RealFeedApp Attacker can log in via SSH without knowing any password
A critical flaw in OpenSSH 10.6p2 allows login without a password if an account lacks one but another has a $5$ or $6$ hash. Users must update openssh-server or disable password authentication immediately.
- Field
- computer security
- What they did
- Researchers discovered a vulnerability in the SSH protocol that allows an attacker to log in without a password by sending a specific long text.
- Why it matters
- This enables hackers to gain access to servers that have at least one user with a password, using the names of accounts that have no password set.
#openssh#alpine linux#ssh#security#authentication
