Cybersecurity & Data Protection
0
UPVOTE
thehackernews.com

OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
SA

SariMartinez

7h ago
0 0

Discussion

Start the conversation

Your voice can be the first to spark an engaging conversation.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

darkreading.com
APT29's Watering Holes Target Thousands of Mobile Users

After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.
DR

Dark Reading

4h ago
0
bleepingcomputer.com
Hackers backdoor Linux servers using trojanized CWP web server

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management in…
Golden Greta

Golden Greta

6h ago
0
thehackernews.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijac…

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be use…
Nirano

Nirano

6h ago
0
bleepingcomputer.com
GhostMap Android flaw lets malicious app trigger persistent boo…

Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [. .…
Marcus Allen

Marcus Allen

13h ago
0
krebsonsecurity.com
Want to Rent an Internet Address at the White House?

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available…
KS

Krebs on Security

18h ago
0
bleepingcomputer.com
Vercel rolls out new protection against stolen session cookie a…

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. [. .. ]
alex but tired

alex but tired

1d ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijac…

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be use…
Nirano

Nirano

6h ago
0
thehackernews.com
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Pa…

A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The att…
LK

Lars Khan

1d ago
0
thehackernews.com
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS…

The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised web…
TN

The Hacker News

1d ago
0
thehackernews.com
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys…

Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords,…
alex but tired

alex but tired

2d ago
0
thehackernews.com
⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code P…

Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that pe…
TN

The Hacker News

2d ago
0
thehackernews.com
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box …

A botnet of more than 1. 3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google s…
TN

The Hacker News

3d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest