"It’s a bad one, and it’s been in the code for a decade:" that is how the post describes a newly disclosed flaw in OpenSSH when used with musl-based C libraries, a bug now being called "sshole."
What "sshole" is
The newly disclosed vulnerability — dubbed "sshole" in the reporting — affects OpenSSH when it runs on musl-based Linux systems. The specific, observable consequence is simple and stark: attackers can log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication simply by entering an oversized password. "Oversized" is defined in the post as any password longer than 256 bytes.
How an oversized password changes authentication
The report emphasizes the bypass is triggered by the length of the password input. Accounts that administrators have explicitly configured to disallow password authentication can nonetheless be accessed if an attacker supplies a password exceeding 256 bytes. The disclosure frames this as a bypass of passwordless or password-protected configurations rather than a new credential or key compromise technique described in the post.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhich systems and accounts are implicated
The post names Alpine Linux and other distributions that use musl as the C standard library as the affected platform category. The vulnerability is limited in the report to "certain Alpine Linux and other musl-based Linux accounts" that are specifically configured to block password authentication; systems not matching that configuration or not built against musl were not described as affected in the post.
Scope and timing: a decade in the code
Two facts the disclosure highlights are temporal and categorical: the flaw is "newly disclosed" and, according to the post, has "been in the code for a decade." That combination — long presence in the codebase and recent disclosure — is the central source of concern in the reporting.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: systems using OpenSSH atop musl (explicitly called out: Alpine Linux and other musl-based distributions) that have accounts configured to block password authentication are the concrete set to identify and examine, because the post states those accounts can be accessed via an oversized (>256-byte) password.
- Affected enterprises and procurement leaders: services and hosts believed to be protected by disabled password authentication should be reviewed against the specific configuration case described in the disclosure; the report’s claim that the bug "has been in the code for a decade" is likely to raise inventory and exposure questions for long-running deployments.
- Adversaries and opportunistic actors: the post documents an easy-to-state exploitation vector — submitting an oversized password — for a specific class of musl-based systems and configurations, which makes the issue one of immediate practical interest to those probing for accessible accounts.
The original post also links to additional material for readers who want more detail, including a "Details" page, a Slashdot thread, and another news article, indicating public discussion and follow-up reporting are already under way.
For now the facts are narrowly drawn: a newly disclosed OpenSSH vulnerability on musl-based systems called "sshole," exploitable by supplying a password longer than 256 bytes, affects Alpine Linux and other musl-based accounts that administrators have configured to block password authentication, and — critically — it has existed in the code for roughly a decade. Whether and when maintainers will publish fixes, advisories, or coordinated disclosures is the concrete question the post leaves standing.
