It’s a bad one, and it’s been in the code for a decade:
A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.
“Oversized” means longer than 256 bytes. Details.
Slashdot thread. And another news article.
Tags: Linux, passwords, SSH, vulnerabilities