OpenSSH flaw lets attackers log into password-disabled Linux accounts

Researcher Ozgun Kultekin disclosed "*sshole," an OpenSSH flaw affecting musl-based Linux systems such as Alpine, OpenWrt, Buildroot, and Yocto. Because musl's crypt() returns "*" when an oversized password (over 256 bytes) fails hashing, attackers can log into accounts locked by a "*" password hash, including default Alpine cloud images.