Alpine on StackRef Whistlehttps://whistle.stackref.com/tags/alpine/Recent content in Alpine on StackRef WhistleHugoen-usFri, 06 Nov 2026 06:00:00 -0500The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systemshttps://whistle.stackref.com/post/2026-11-06-cve-bulletin-openssh-sshhole/Fri, 06 Nov 2026 06:00:00 -0500https://whistle.stackref.com/post/2026-11-06-cve-bulletin-openssh-sshhole/<p>OpenSSH shipped an emergency release one day after learning of the bug, with Damien Miller telling musl-libc operators to disable password auth <a href="https://marc.info/?l=openssh-unix-dev&amp;m=179388064263131&amp;w=2">IMMEDIATELY</a>. <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-123158">CVE-2026-123158</a> at CVSS 8.1 lets an attacker log into any passwordless account with a single sent password, first connection, every time. glibc distributions and PAM-using systems are not affected, which is why your Ubuntu fleet is safe. Your Alpine containers with an sshd inside are another matter.</p>