[dependabot]

Bumps russh from 0.64.1 to 0.65.0.

Release notes

Sourced from russh's releases.

v0.65.0

Breaking changes

• d507707: feat(server): expose the publickey algorithms to Handler (#785) (@​Eric-D) #785
  • Handler::auth_publickey_offered now takes a server::PublicKeyOffer and Handler::auth_publickey takes a server::VerifiedPublicKey instead of &PublicKey. Read the key from the public_key field. The new algorithm field makes accessible the signature algorithm used by the client, allowing the server to react to it
• 62efa5a: Remove the no-op async-trait dependency and crate feature (#786) (@​FalkWoldmann) #786

Security fixes

GHSA-9wfm-jcj8-jfv9 - russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

• 23aa5d2 - A malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-4p9f-7p9m-5vfg - russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

• b33e93b - russh did not limit the number of EXT_INFO messages that a malicious server can send, leading to unbounded memory growth over time

GHSA-fw5c-8223-6h42 - russh: peer-declared zero maximum packet size permanently stalls channel writes

• 39cb9db - malicious peers can hang up the channel by setting max packet size to zero

GHSA-662x-8wvj-2276 - pageant: unbounded frame buffering on peer-controlled 4-byte length prefix

• 69e4b55 - a malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-vp5q-ff62-jwqv - Agent server never calls Agent::confirm

• 62db6e7 - Agent::confirm was defunct and never got called by the agent server

GHSA-3hm4-p7h4-rvwp - russh: pre-authentication stack exhaustion via nested OpenSSH certificates

• 730d663 - a malicious client could trigger a stack overflow via a crafted OpenSSH certificate

Features

• d65823f: feat(client): support OpenSSH agent session binding (#794) (@​inureyes) #794
  • Exposes the verified initial key-exchange data through a typed AgentSessionBinding. You need it to send session-bind@openssh.com for OpenSSH destination-constrained agent keys.

Fixes

• 13c94f0: Fix channel window accounting on window adjust (#790) (@​notsapinho) #790
• e2bdf85: client: keep the session usable when a Signer fails after PK_OK (#788) (@​meanaverage) #788
• b10506e: Re-arm the client keepalive timer before authentication (#791) (@​Bokjan) #791
  • Fixes the client session task spinning on a CPU core when the keepalive timer fired before authentication.
• c1fada1: fix(agent): honor SSH_AGENT_RSA_SHA2_* flags when signing with RSA keys (#796) (@​mdevolde) #796
• 3beb126: client: don't arm the rekey timer on wasm32 (#797) (@​biao29) #797

New Contributors

• @​Eric-D made their first contribution in Eugeny/russh#785

... (truncated)

Commits

• 183a22e v0.65.0
• 39cb9db reject zero max packet size
• 69e4b55 limit pageant message sizes
• 62db6e7 call Agent::confirm
• b33e93b limit ext_info messages
• 730d663 check certificate nesting
• 23aa5d2 dedupe agent constraints
• d65823f feat(client): support OpenSSH agent session binding (#794)
• d507707 feat(server): expose the publickey algorithms to Handler (#785)
• 13c94f0 Fix channel window accounting on window adjust (#790)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)