Pre-auth Denial-of-Service Vulnerability Reported in russh 0.62.2
An early warning has been issued regarding a potential pre-authentication denial-of-service vulnerability in russh version 0.62.2. This issue reportedly allows an unauthenticated client to trigger a panic by sending a specific malformed SSH message.
What happened
According to the initial report, russh version 0.62.2 appears to be susceptible to a pre-authentication denial-of-service attack. This vulnerability is under investigation and is associated with the sending of an SSH_MSG_KEX_ECDH_INIT message containing a 32-byte zero value for Q_C. Such a message could potentially cause the russh server to panic.
Professional software engineers using russh in their projects are advised to monitor for updates from the russh maintainers that address this issue. As a precautionary measure, consider switching to a version of russh where this vulnerability has been fixed, if available.
For more detailed information, the primary sources should be consulted. The exact scope and impact of this vulnerability are still under investigation, and further details may emerge as the situation develops.
How 0Day mitigates this
russh is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.