Security researchers: Alpine SSH password bypass vulnerability has been successfully exploited

On November 10, according to The Defiant, security firm GreyNoise stated that an SSH password authentication bypass vulnerability affecting some Alpine Linux systems has been successfully exploited.

On November 6, GreyNoise noted that it is monitoring scanning, exploitation attempts, and successful exploitation activity targeting the vulnerability. Between November 6 and 8, another security firm, Previdian, logged 20 exploitation attempts from 13 different IP addresses across four sensors; however, these observations do not confirm that the targets were vulnerable or that the attempts were successful.

Alpine recommends operators install the corresponding OpenSSH patch package and restart the SSH service; users unable to update may disable password authentication and restart the service.