Описание
Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.
Ссылки
- Patch
- ProductRelease Notes
- ExploitMitigationVendor Advisory
- ExploitMitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.60.1 (исключая)Версия до 0.23.1 (исключая)
Одно из
cpe:2.3:a:russh_project:russh:*:*:*:*:*:rust:*:*
cpe:2.3:a:warpgate_project:warpgate:*:*:*:*:*:*:*:*
EPSS
Процентиль: 39%
0.00481
Низкий
7.5 High
CVSS3
Дефекты
CWE-770
Связанные уязвимости
CVSS3: 7.5
debian
3 месяца назад
Russh is a Rust SSH client & server library. Prior to version 0.60.1, ...
CVSS3: 7.5
github
4 месяца назад
russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler
EPSS
Процентиль: 39%
0.00481
Низкий
7.5 High
CVSS3
Дефекты
CWE-770