From 629df29b2b966c1e0927be5206c8aff484c36aef Mon Sep 17 00:00:00 2001 From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:08:17 +0800 Subject: [PATCH] docs(deps): name the russh advisories, two of which reach a client pre-auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Last commit hedged on whether the missing russh fixes matter to a client, because the release notes describe them as a client crashing its own session. Matching the whole lockfile against the GitHub advisory database settles it — the advisory titles say plainly what the release notes did not: GHSA-5xvq-cp9x-6p6r "Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)" GHSA-g9hv-x236-4qp3 "client wrong-length X25519 clone_from_slice panic (pre-auth DoS)" tty7 is the client, the peer is whatever server a profile dials, and this lands before authentication — so anything sitting in front of that server reaches it too. Both are patched in 0.62.4; this rev is from 2026-07-14 and predates it. The other three are named too, with the two server-side ones marked as such since tty7 runs no SSH server. Still documentation only, for the reason the previous commit gives: moving the SSH layer wants an SSH connection to test against, and connecting needs the GUI connection manager, which this environment cannot drive. The fix is unchanged — rebase the fork onto v0.62.6+, and drop the patch once #738 ships in a release. 2937 tests pass. --- Cargo.toml | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index f96e8f9c..62756c97 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -339,23 +339,29 @@ smol = "2" # still needed. # # - THIS REV IS OLDER THAN THE UPSTREAM SECURITY FIXES. It is dated -# 2026-07-14 and branched before v0.62.3, so it does not contain: -# v0.62.4 (2026-07-22) GHSA-cqjc-rmpq-xprq, GHSA-g9hv-x236-4qp3, -# GHSA-5xvq-cp9x-6p6r — malformed PTY request, -# malformed Curve25519 KEX packet, zero Curve25519 -# key. Upstream describes them as a client crashing -# its own session, but "fix mpint encoding and -# validate curve25519 keys" (a7fc1eb) is in key -# exchange, which a *client* also runs against -# whatever server it dials — worth assessing rather -# than assuming it is server-only. -# v0.62.5 (2026-07-31) GHSA-m65r-rprj-r5rg — channel IDs not validated. -# v0.62.6 (2026-08-11) GHSA-g6xm-f9xp-qq35 — max_auth_attempts. +# 2026-07-14 and branched before v0.62.3, so it carries none of these — +# matched against the GitHub advisory database, which names two of them as +# reachable by a *client* before authentication: # -# The last two are described as server-side and tty7 runs no SSH server, so -# they most likely do not apply; the KEX ones are the reason this note -# exists. Until #738 ships in a release, the fix is to rebase the fork onto -# v0.62.6 (or later) and move this rev forward. +# GHSA-5xvq-cp9x-6p6r Pre-auth remote panic via all-zero Curve25519 peer +# public value (encode_mpint OOB). patched 0.62.4 +# GHSA-g9hv-x236-4qp3 Client wrong-length X25519 `clone_from_slice` +# panic (pre-auth DoS). patched 0.62.4 +# GHSA-cqjc-rmpq-xprq Post-auth remote panic via pty-req with more than +# 130 terminal-mode records. patched 0.62.4 +# GHSA-m65r-rprj-r5rg Channel-scoped server callbacks reachable without +# an open channel. patched 0.62.5 +# GHSA-g6xm-f9xp-qq35 Server-side max_auth_attempts not enforced. +# patched 0.62.6 +# +# The first two are the ones that matter here: tty7 is the client, and the +# peer is whatever server a profile dials — or anything sitting in front of +# it, since this lands before authentication. The last two are server-side +# and tty7 runs no SSH server. Not reproduced against tty7; the ranges and +# the fork's position are verified, the exploitability is upstream's word. +# +# Until #738 ships in a release, the fix is to rebase the fork onto v0.62.6 +# (or later) and move this rev forward. russh = { git = "https://github.com/ayamir/russh", rev = "0d1d073350ed823069252075cbf3db9672d5b490" } [workspace.lints.clippy]