OpenSSH 10.6p2 发布，包含针对关键漏洞的临时解决方案
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
OpenSSH 10.6p2 已正式发布，包含针对一项关键漏洞的临时解决方案。该漏洞影响使用 musl libc 且无 PAM 的 Linux 系统（例如 Alpine Linux），官方建议立即设置 PasswordAuthentication=no 或禁用 SSH。由于观察到 AI एजेंट 能够迅速重新发现漏洞，开发团队选择尽快发布此版本以缩短安全公告期。
- Skip to main contentHotkey 1
- Skip to main navigationHotkey 2
Recent searches
No recent searches
Search options
Only available when logged in.
hachyderm.io is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hachyderm is a safe space, LGBTQIA+ and BLM, primarily comprised of tech industry professionals world wide. Note that many non-user account types have restrictions - please see our About page.
Administered by:
Server stats:
7.4K
active users
hachyderm.io:
Mastodon:
Back
Damien Miller@damienmiller@hachyderm.io
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.
https://openssh.com/releasenotes.html#10.6p2
If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.
We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.
Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this problem to us and for the Alpine Linux developers for making an updated release available at very short notice.
openssh.comOpenSSH: Release NotesOpenSSH release notes
77 boosts·5 quotes·33 favorites
Leah Neukirchen@leah@blahaj.social22m
@damienmiller can you clarify if this applies to a build with --with-pam but then using "UsePAM no"?
1
@leah yes it does apply to this configuration
1
Leah Neukirchen@leah@blahaj.social11m
@damienmiller the release notes say "when built and run with PAM support disabled." that should be "or" then?
0
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Drag & drop to upload
来源：Hacker News-首页 · hachyderm.io