CVE-2023-28113: russh_project russh Improper Input Validation

Vulnerability summary

CVE-2023-28113 is a medium (CVSS 5.9) Improper Input Validation vulnerability in russh_project russh. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-03-2023
   PublishedVulnerability first disclosed.
2. 25-02-2025
   Last modifiedVulnerability information updated.

Description

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-358Improperly Implemented Security Check for StandardThe product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
• CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.