Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
russh may use insecure Diffie-Hellman keys
Vulnerability Description
russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
输入验证不恰当
Vulnerability Title
russh 数据伪造问题漏洞
Vulnerability Description
russh是Rust SSH 客户端和服务器端库。 russh 0.34.0版本和0.36.1版本存在数据伪造问题漏洞，该漏洞源于Diffie-Hellman密钥验证不充分，从而导致信息泄露，破坏机密性。
CVSS Information
N/A
Vulnerability Type
N/A