CyberRota Analysis
AI-GeneratedThe Russh library, used for SSH client and server functionality in Rust applications, contains a vulnerability where it improperly dispatches channel-scoped Handler callbacks for recipient channel IDs that have not been opened or confirmed. This flaw could potentially lead to unauthorized access or execution of commands, impacting the security of applications relying on this library. Developers and organizations utilizing Russh versions prior to 0.62.5 should prioritize updating to the latest version to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.