Lucene search

CVE-2023-28113

🗓️ 16 Mar 2023 21:13:15Reported by [email protected]Type

Russh version 0.34.0 to 0.36.1 suffers from insufficient Diffie-Hellman key validation, leading to insecure shared secrets and confidentiality breaks

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2023-28113 russh may use insecure Diffie-Hellman keys	16 Mar 202300:00	–	cvelist
Vulnrichment	CVE-2023-28113 russh may use insecure Diffie-Hellman keys	16 Mar 202300:00	–	vulnrichment
OSV	CVE-2023-28113	16 Mar 202321:15	–	osv
OSV	russh may use insecure Diffie-Hellman keys	17 Mar 202314:42	–	osv
Prion	Input validation	16 Mar 202321:15	–	prion
Github Security Blog	russh may use insecure Diffie-Hellman keys	17 Mar 202314:42	–	github
CVE	CVE-2023-28113	16 Mar 202321:15	–	cve

Nvd

Node

russh_project russhRange0.34.0–0.36.2rust

russh_project russhMatch0.37.0-rust

russh_project russhMatch0.37.0beta1rust

Source	Link
github	www.github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs
github	www.github.com/warp-tech/russh/releases/tag/v0.36.2
github	www.github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e
github	www.github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg
github	www.github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs
github	www.github.com/warp-tech/russh/releases/tag/v0.37.1

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

16 Mar 2023 21:15Current

5.5Medium risk

Vulners AI Score5.5

CVSS35.9

EPSS0.00183

russh ssh client server library diffie-hellman key validation insecure secrets confidentiality vulnerability eavesdropping