OpenSSH 10.6p2 發佈，為嚴重漏洞提供臨時緩解方案
OpenSSH 10.6p2 已发布，其中包含针对一个严重漏洞的临时解决方案
OpenSSH 發佈 10.6p2，為一項嚴重漏洞提供臨時緩解方案。使用 musl libc 且未使用 PAM 作密碼驗證的 Linux 系統（例如 Alpine Linux），應立即設定 PasswordAuthentication=no 或停用 SSH。非 Linux 系統、Linux/glibc 系統，以及使用 PAM 作密碼驗證的 Linux 系統不受此漏洞影響。
- Skip to main contentHotkey 1
- Skip to main navigationHotkey 2
Recent searches
No recent searches
Search options
Only available when logged in.
hachyderm.io is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hachyderm is a safe space, LGBTQIA+ and BLM, primarily comprised of tech industry professionals world wide. Note that many non-user account types have restrictions - please see our About page.
Administered by:
Hachyderm@hachydermServer stats:
7.4K
active users
hachyderm.io:
Mastodon:
Back
Damien Miller@damienmiller@hachyderm.io
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.
https://openssh.com/releasenotes.html#10.6p2
If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.
We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.
Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this problem to us and for the Alpine Linux developers for making an updated release available at very short notice.
openssh.comOpenSSH: Release NotesOpenSSH release notes
339 boosts·8 quotes·170 favorites
Leah Neukirchen@leah@blahaj.social6h
@damienmiller can you clarify if this applies to a build with --with-pam but then using "UsePAM no"?
1
@leah yes it does apply to this configuration
1
Leah Neukirchen@leah@blahaj.social6h
@damienmiller the release notes say "when built and run with PAM support disabled." that should be "or" then?
0
Daniel Gibson@Doomed_Daniel@mastodon.gamedev.place6h *
@damienmiller
Do you have any information about the musl vulnerability? Is it one already fixed upstream (is it that regex thing)?
Do you know if Dropbear SSH is also affected (used commonly on embedded systems with musl)?
2
@Doomed_Daniel I'll leave that for others to talk about. I'd rather not myself at this stage
1
Daniel Gibson@Doomed_Daniel@mastodon.gamedev.place5h
@damienmiller
according to https://fosstodon.org/@ncopa/117563341 498491523
Dropbear is not affected
Natanael Copa@ncopa@fosstodon.org5h
dropbear is not affected. I have verified the dropbear sources.
https://github.com/mkj/dropbear/blob/m ain/src/svr-authpasswd.c#L70-L108
Quoted a post by @Doomed_Daniel@mastodon.gamedev.place
0
Cassandrich@dalias@Doomed_Daniel@damienmiller Dropbear is not affected. My position is that it is not a musl vulnerability, but I'll refrain from going into any details right now because the important thing is that affected folks get this mitigated before attackers start using it.
1
Daniel Gibson@Doomed_Daniel@mastodon.gamedev.place5h
@dalias@damienmiller
thank you :)
0
Mx Amber Alex (she/it) 😷@amberage@eldritch.cafe5h
@damienmiller can someone translate this to non-techie speak?
1
guenther@guenther@chaos.social4h
SSH is what admins use to access their servers. OpenSSH is the software that runs on the server, checks their identity and gives them access. PAM is a software involved in checking passwords. Glibc and musl are core system components that basically do the same thing, and each Linux server usually runs one or the other, with musl being the less popular choice. 1/2
1
guenther@guenther@chaos.social4h
It sounds like for some servers with a specific setup, there's probably a security issue that gives everyone on the internet admin access to those servers. Fortunately, the combination of software required for this problem to exist really is not the most common one, but if a server is configured this way, it's basically the worst imaginable sort of security problem. 2/2
1
Mx Amber Alex (she/it) 😷@amberage@eldritch.cafe4h
@guenther@damienmiller thanks! So if I don't have a server, I don't need to rush to plug any holes?
2
guenther@guenther@chaos.social4h
@amberage Not for this problem at least :)
0
Tofuraven@@amberage If you don't have a server or a PC that you remotely access, yes.
(This distinction's mainly relevant for cases like "desktop usage while not home" or "remote access is more practical on a Steam Deck than typing with a controller")
@guenther
1
Mx Amber Alex (she/it) 😷@amberage@eldritch.cafe1h
@tofu@guenther none of these, no
0
niconiconi@niconiconi@mk.absturztau.be4h
@damienmiller@hachyderm.io Fortunately I've long disabled password authentication on all servers.
0
stf@@damienmiller i'm quite suprised to learn that the default for PasswordAuthentication is yes if it is not set in the config file.
0
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Drag & drop to upload
來源：Hacker News 熱門（buzzing.cc 中文翻譯） · hachyderm.io