*sshole
CVE-2016-6210Lets attackers log into password-disabled Linux accounts
The *sshole flaw allows an attacker to bypass password authentication on Linux accounts by entering a password longer than 256 bytes. The vulnerability affects OpenSSH running on systems using the musl C library, a lightweight standard C library for Linux. A fix has been released in OpenSSH 10.6p2.
n/a · Updated 6 Nov · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritymediumCVSS 5.9 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Update OpenSSH to version 10.6p2, which contains the official fix. Prioritize patching systems that use the musl C library, such as Alpine Linux. The OpenSSH developers provided this version as the solution.
What happened
- 1 JanThe *sshole vulnerability is introduced in the OpenSSH codebase.
- 5 NovÖzgün Kültekin discloses the *sshole flaw and says it was found using AI agents.
- 5 NovOpenSSH releases version 10.6p2 to patch the *sshole vulnerability.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2016-6210 | sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exis… | medium 5.9 | No | 89% |
Our reporting
5 NovDecade-old *sshole flaw lets attackers log into password-disabled Linux accounts via oversized passwordsReported elsewhere
BleepingComputer · 5 NovOpenSSH flaw lets attackers log into password-disabled Linux accounts ↗The records
access.redhat.com: advisory ↗debian.org: advisory ↗security.gentoo.org: advisory ↗access.redhat.com: advisory ↗CVE-2016-6210 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free