OpenSSH password authentication bypass in Alpine Linux (openssh-server)
Summary
This security advisory from Alpine Linux details an openssh-server vulnerability that allows password authentication bypass when PasswordAuthentication is enabled and the server runs without PAM. The advisory lists affected releases, provides remediation steps (update openssh, or disable password authentication), and explains the underlying mechanism involving how OpenSSH and musl crypt interact with password fields. It also covers risk scenarios, guidance for verification, and notes on cloud/tiny-cloud images and end-of-life releases.