Alpine Linux releases security updates for versions 3.21 through 3.24
New Alpine Linux stable releases address a critical OpenSSH password authentication bypass and a crash vulnerability in the apk-tools package manager.
Summary
The Alpine Linux project has issued maintenance updates for four stable release branches: 3.21.10, 3.22.8, 3.23.8, and 3.24.4. These updates focus on addressing specific security vulnerabilities within core system components used across the distribution.
Users running OpenSSH servers are particularly affected by a password authentication bypass vulnerability. Additionally, the package management tool, apk-tools, received patches to prevent system crashes when encountering malformed data.
Security fixes in OpenSSH and apk-tools
- OpenSSH: A vulnerability in openssh-server allows for a password authentication bypass; administrators are advised to update the package and restart the service or disable PasswordAuthentication if updates are not immediately possible.
- apk-tools: Versions 3.0.9 and 2.14.13 include fixes to prevent the package manager from crashing when processing specific types of malformed data.
- Release Scope: The updates are applied across multiple stable branches, specifically versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4.
Why it matters
Because Alpine Linux is widely used in containerized environments and minimal server deployments, these fixes are critical for maintaining the security posture of microservices. The OpenSSH fix is especially vital for any Alpine-based system exposed to network-based authentication attempts.
What to do
- Update to Alpine Linux versions 3.21.10, 3.22.8, 3.23.8, or 3.24.4.
- If running openssh-server, update the package and restart the service.
- If you cannot update openssh-server immediately, set PasswordAuthentication to no.
Original reference: alpinelinux.org →