Monthly
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.