OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

7 comments

• throwa356262 2 hours ago

  musl only, the quick fix:

       PasswordAuthentication=no
  
  

  Which is a good advice in general.
• jordiburgos an hour ago

  Workaround? Why not a fix?

  [-]
  • ale42 40 minutes ago

    AFAIU because the bug is in musl and not in OpenSSH

• crest an hour ago

  I'm sure some people running lightweight containers just had a heart attack.

  [-]
  • smw 4 minutes ago

    I would imagine the vast majority of lightweight containers don't contain an ssh server?

• phoronixrly an hour ago

  I presume Dropbear, thus musl-based OpenWrt routers are also not affected? Not that Dropbear has been an example in that regard.

  [-]
  • manwe150 an hour ago

    Since after you posted, various people in the thread have reported dropbear is not affected