Pre-auth Panic Vulnerability in russh 0.62.2 Under Investigation
An early warning has been issued regarding a potential pre-authentication denial-of-service vulnerability in russh version 0.62.2. This vulnerability, if exploited, could allow an unauthenticated client to cause a panic by sending a specifically crafted SSH message.
What happened
Reportedly, the vulnerability allows an attacker to send a single SSH_MSG_KEX_ECDH_INIT message with a 32-byte all-zero Q_C value, triggering a panic in the russh software. This could potentially lead to a denial-of-service condition.
The vulnerability is being tracked under the IDs CVE-2023-28113 and GHSA-5XVQ-CP9X-6P6R. It is recommended that users of russh version 0.62.2 monitor for updates from the maintainers that address this issue.
Professional software engineers using russh in their projects should review their dependencies and assess their exposure to this vulnerability. Further details and confirmations are expected as the investigation progresses. Primary sources should be consulted for the most accurate and up-to-date information.
How 0Day mitigates this
russh is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.