RadioCSIRT

Ep.792 - Spécial OpenSSH, la faille sshole sur Alpine Linux - vendredi 6 novembre 2026

Play Episode Pause Episode

1x

00:00 /

RSS Feed

Share

Link

Embed

<blockquote class="wp-embedded-content" data-secret="nisDa75Z5U"><a href="https://www.radiocsirt.org/podcast/ep-792-special-openssh-la-faille-sshole-sur-alpine-linux-vendredi-6-novembre-2026/">Ep.792 &#8211; Spécial OpenSSH, la faille sshole sur Alpine Linux &#8211; vendredi 6 novembre 2026</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.radiocsirt.org/podcast/ep-792-special-openssh-la-faille-sshole-sur-alpine-linux-vendredi-6-novembre-2026/embed/#?secret=nisDa75Z5U" width="500" height="350" title="« Ep.792 &#8211; Spécial OpenSSH, la faille sshole sur Alpine Linux &#8211; vendredi 6 novembre 2026 » &#8212; RadioCSIRT" data-secret="nisDa75Z5U" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script> /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); //# sourceURL=https://www.radiocsirt.org/wp-includes/js/wp-embed.min.js </script>

🐛 OpenSSH 10.6p2, publiée le 5 novembre 2026, corrige la CVE-2026-123158, contournement de l’authentification par mot de passe de sshd sur Linux avec musl libc sans PAM. Fiche CVE : score CVSS de 8,1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-394, valeur de retour ou code d’état inattendu ; OpenSSH la qualifie de critique, absente du catalogue KEV de la CISA. Un mot de passe de 257 à 1 024 octets ouvre tout compte à * ; Previdian confirme un accès root sur un honeypot, puis une reconnaissance T1033 et T1082. Paquets Alpine corrigés : edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1 ; Alpine demande ensuite rc-service sshd restart, ou à défaut PasswordAuthentication no.

Sources :

• La faille OpenSSH permet aux attaquants de se connecter à des comptes Linux où l’authentification par mot de passe est désactivée. Reddit, r/cybersecurity : https://www.reddit.com/r/cybersecurity/comments/1xpg7ot/openssh_flaw_lets_attackers_log_into/
• OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158). Help Net Security : https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/
• *sshole. Özgün Kültekin, Wakefield : https://sshhole.com
• Critical OpenSSH Authentication Bypass Lets Hackers Log In Without Knowing Passwords. Cyber Security News : https://cyberpress.org/critical-openssh-authentication/
• OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux. The Hacker News : https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
• Security advisory: openssh-server password authentication bypass. Alpine Linux : https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
• OpenSSH 10.6p2 Release Notes. OpenSSH : https://www.openssh.org/releasenotes.html#10.6p2
• SSHole: OpenSSH Authentication Bypass, CVE-2026-123158. TheCyberThrone : https://thecyberthrone.in/2026/11/06/sshole-openssh-authentication-bypass-cve-2026-123158/
• CVE-2026-123158. CVE Program : https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123158.json

⚡️ On ne réfléchit pas, on patch !

📞 Répondeur : 07 68 72 20 09 📩 Email : contact@radiocsirt.org 🌐 Site : https://www.radiocsirt.org 📰 Newsletter : https://radiocsirt.substack.com

#CyberSecurity #CERT #CSIRT #SOC #VOC #ThreatIntelligence #OpenSSH #sshole #AlpineLinux #musl #Linux #SSH #AuthenticationBypass #Previdian #SOCRadar #Wakefield #CVE-2026-123158 #RadioCSIRT