OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

(hachyderm.io)

36 points

[-]

musl only, the quick fix:

     PasswordAuthentication=no

Which is a good advice in general.

[-]

Workaround? Why not a fix?

[-]

AFAIU because the bug is in musl and not in OpenSSH

[-]

I'm sure some people running lightweight containers just had a heart attack.

[-]

I would imagine the vast majority of lightweight containers don't contain an ssh server?

[-]

I presume Dropbear, thus musl-based OpenWrt routers are also not affected? Not that Dropbear has been an example in that regard.

[-]

Since after you posted, various people in the thread have reported dropbear is not affected