{"id":184154,"date":"2026-11-05T23:41:11","date_gmt":"2026-11-05T21:41:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/sshole-uyazvimost-pozvolyayushhaya-podklyuchitsya-po-ssh-bez-parolya-v-sistemah-s-musl"},"modified":"2026-11-05T23:41:15","modified_gmt":"2026-11-05T21:41:15","slug":"sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","title":{"rendered":"SSHole \u2014 zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje pripojenie cez SSH bez hesla v syst\u00e9moch s Musl","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri OpenSSH zverejnili mimoriadnu aktualiz\u00e1ciu OpenSSH 10.6p2, ktor\u00e1 priniesla ochranu pred kritickou zranite\u013enos\u0165ou (CVE zatia\u013e nepriraden\u00e1), ozna\u010dovanou k\u00f3dov\u00fdm n\u00e1zvom \u201eSSHole\u201c, ktor\u00e1 umo\u017e\u0148uje ob\u00eds\u0165 autentifik\u00e1ciu. V syst\u00e9moch s kni\u017enicou Musl t\u00e1to zranite\u013enos\u0165 umo\u017e\u0148uje pripoji\u0165 sa ako pou\u017e\u00edvate\u013e bez nastaven\u00e9ho hesla, ak je zadan\u00e9 ak\u00e9ko\u013evek heslo, ktor\u00e9 obsahuje viac ako 256 znakov. Probl\u00e9m sa t\u00fdka distrib\u00faci\u00ed Linuxu, ktor\u00e9 pou\u017e\u00edvaj\u00fa \u0161tandardn\u00fa kni\u017enicu musl, ale nepou\u017e\u00edvaj\u00fa PAM (Pluggable Authentication Modules), ako s\u00fa OpenWRT, Alpine, Buildroot a Yocto. Obzvl\u00e1\u0161\u0165 nebezpe\u010dn\u00e9 je, \u017ee prihl\u00e1senie pomocou hesla je \u010dasto zablokovan\u00e9 pre pou\u017e\u00edvate\u013ea root, \u010do umo\u017e\u0148uje komuko\u013evek pripoji\u0165 sa s pr\u00e1vami spr\u00e1vcu.<\/p>\n

Zranite\u013enos\u0165 nevypl\u00fdva z k\u00f3du OpenSSH, ale je zneu\u017e\u00edvan\u00e1 cez sshd. Vzh\u013eadom na z\u00e1va\u017enos\u0165 probl\u00e9mu bol v verzii OpenSSH 10.6p2 navrhnut\u00fd obch\u00e1dzac\u00ed sp\u00f4sob, ako zablokova\u0165 zranite\u013enos\u0165. Vlastn\u00edkom postihnut\u00fdch syst\u00e9mov sa odpor\u00fa\u010da, aby ne\u010dakali na aktualiz\u00e1cie, ale okam\u017eite zak\u00e1zali autentifik\u00e1ciu pomocou hesla s parametrom \u201ePasswordAuthentication no\u201c v \/etc\/ssh\/sshd_config alebo \u00faplne vypnuli SSH. <\/p>\n

Probl\u00e9m sa neprejavuje v syst\u00e9moch okrem Linuxu a v Linuxov\u00fdch prostrediach na b\u00e1ze glibc, ako aj v syst\u00e9moch, ktor\u00e9 pou\u017e\u00edvaj\u00fa PAM pri autentifik\u00e1cii pomocou hesla. Oprava je u\u017e dostupn\u00e1 v Alpine a OpenWRT.<\/p>\n

Zranite\u013enos\u0165 s\u00favis\u00ed s nespr\u00e1vnou interakciou OpenSSH a funkcie crypt() z musl. Na ochranu pred zis\u0165ovan\u00edm existencie pou\u017e\u00edvate\u013eov anal\u00fdzou rozdielov v \u010dase spracovania po\u017eiadaviek odvtedy OpenSSH pri kontrole bezheslov\u00fdch \u00fa\u010dtov vyu\u017e\u00edva \u0161tandardn\u00fd postup overovania hesla: vyvol\u00e1va funkciu \u201ecrypt(zadan\u00e9 heslo, so\u013e)\u201c so so\u013eou in\u00e9ho pou\u017e\u00edvate\u013ea, ktor\u00fd m\u00e1 platn\u00fd hash hesla, a potom porovn\u00e1va hash vr\u00e1ten\u00fd funkciou crypt s hodnotou z po\u013ea s hashom hesla.<\/p>\n

V musl funkcia crypt() pre hashovanie SHA-512 vracia znak \u201e*\u201c, ak d\u013a\u017eka zadan\u00e9ho hesla presahuje 256 bajtov (toto obmedzenie bolo zaveden\u00e9 v roku 2012 na ochranu pred DoS \u00fatokmi, preto\u017ee pri prenose ve\u013ek\u00fdch hodn\u00f4t sa vytv\u00e1ra ve\u013ek\u00e1 z\u00e1\u0165a\u017e na CPU). Ten ist\u00fd znak sa pou\u017e\u00edva v poli s hashom hesla v \u201e\/etc\/shadow\u201c na ozna\u010denie \u00fa\u010dtov, pre ktor\u00e9 je autentifik\u00e1cia pomocou hesla zablokovan\u00e1. <\/p>\n

V d\u00f4sledku \u00fatoku m\u00f4\u017ee \u00fato\u010dn\u00edk, ktor\u00fd m\u00e1 schopnos\u0165 pripoji\u0165 sa k SSH serveru, z\u00edska\u0165 pr\u00edstup k \u013eubovo\u013en\u00e9mu \u00fa\u010dtu, ktor\u00e9ho pole hesla v « \/etc\/shadow » obsahuje znak « * », pokia\u013e odo\u0161le re\u0165azec s d\u013a\u017ekou od 257 do 1024 bajtov. Probl\u00e9m sa t\u00fdka viacer\u00fdch existuj\u00facich Docker obrazov postaven\u00fdch na Alpine Linux, ako aj ofici\u00e1lnych obrazov Alpine pre cloudov\u00e9 syst\u00e9my AWS a Azure, kde m\u00e1 pou\u017e\u00edvate\u013e root namiesto hash hesla nastaven\u00fd znak « * ». <\/p>\n

Je pozoruhodn\u00e9, \u017ee v p\u00f4vodn\u00fdch ofici\u00e1lnych Docker obrazov, ktor\u00e9 pou\u017e\u00edvaj\u00fa Alpine, bol od roku 2015 nastaven\u00fd pr\u00e1zdny heslo pre root, a po zisten\u00ed tohto faktu bol namiesto hash hesla nastaven\u00fd znak « ! ». Av\u0161ak jeho pr\u00edtomnos\u0165 blokovala pr\u00edstup cez SSH k\u013e\u00fa\u010de, a preto bol od roku 2022 znak na zablokovanie pr\u00edstupu pomocou hesla nahraden\u00fd znakom « * ».
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 10.6p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f «SSHole» \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e. \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Musl \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0430\u0440\u043e\u043b\u044c, \u0432\u0432\u0435\u0434\u044f \u043b\u044e\u0431\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u0435 \u0447\u0435\u043c 256 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184154","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSHole \u2014 zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje pripojenie cez SSH bez hesla v syst\u00e9moch s Musl | ProHoster","description":"V\u00fdvoj\u00e1ri OpenSSH vydali urgentn\u00fa aktualiz\u00e1ciu OpenSSH 10.6p2, ktor\u00e1 obsahuje ochranu pred kritickou zranite\u013enos\u0165ou (CVE nepri\u0159aden\u00e9), ktor\u00e1 dostala k\u00f3dov\u00e9 meno \"SSHole\" a umo\u017e\u0148uje ob\u00eds\u0165 autentifik\u00e1ciu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSHole \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e SSH \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 Musl | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 10.6p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f "SSHole" \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-05T21:41:11+00:00","article:modified_time":"2026-11-05T21:41:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=184154"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184154\/revisions"}],"predecessor-version":[{"id":184155,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/184154\/revisions\/184155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=184154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=184154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=184154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}