CVEvulnerability

CVE-2023-28113

5.9 MEDIUM Published 2023-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-347, CWE-358

Description

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1

Affected configurations

• russh project russh (>= 0.34.0 < 0.36.2) • russh project russh 0.37.0

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness
  • CWE-358 Improperly Implemented Security Check for Standard weakness

References