chore(deps): bump russh from 0.62.5 to 0.63.2

[dependabot]

Bumps russh from 0.62.5 to 0.63.2.

Release notes

Sourced from russh's releases.

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

• client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
• 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
• b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
• 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
• a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
• 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

  • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

  • Adds a Config::certificates that functions similarly to Config::keys

Fixes

• f2354c7: improve strict kex checks (Eugene)
• 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
• 46c927a: use constant-time comparison for agent unlock (Eugene)
• 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

... (truncated)

Commits

• 8a51a0d v0.63.2
• 422123c dedup zlib compress loop into compress_into
• a04e1b5 fixed #758 - fail RSA signing explicitly when RSA feature is not enabled
• af91598 fmt
• b1d3893 fixed #762 - redact sensitive data from debug logging
• a282af3 fix rekey message queueing
• 5d56698 fix read bounds in pageant
• 675b631 bump num-bigint
• 24e2c37 fix for latest minz_oxide
• 9c86cb8 Merge branch 'main' of github.com:warp-tech/russh
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[datadog-official]

More details

The manifest and lockfile consistently resolve russh 0.63.2 and its expected transitive dependency updates, with no actionable compatibility regression identified.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 37b517c · @DataDog review to ask questions}