GCVE - cpe:2.3:a:russh_project:russh:0.37.0:-:*:*:*:rust:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:russh_project:russh:0.37.0:-:*:*:*:rust:*:*

part: a version: 0.37.0 update: -

Vendor	Russh Project (`c8b39e4d-20e9-5baf-ba83-bb3b9fd7ffb1`)
Product	Russh (`c04e758a-336d-5cf5-b282-877109a6d3fc`)
Edition	*
Language	*
Software edition	*
Target software	rust
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/warp-tech/russh`	purl2cpe	2026-06-01 10:15:45.900456

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-28113`	vulnerable	2026-06-08 06:01:09.680334	russh may use insecure Diffie-Hellman keys MEDIUM (5.9) russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1 Published: 2023-03-16T00:00:00.000Z Updated: 2025-02-25T14:55:51.611Z Open on db.gcve.eu Reference links https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76 https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81 https://github.com/warp-tech/russh/releases/tag/v0.36.2 https://github.com/warp-tech/russh/releases/tag/v0.37.1	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.