Executive Summary

This vulnerability exists in the russh Rust SSH client and server library versions from 0.34.0-beta.1 up to but not including 0.61.0. The issue is that the server authentication path keeps internal user authentication state across SSH_MSG_USERAUTH_REQUEST messages without properly separating that state when the request principal (user or service) changes.

According to RFC 4252, the user name and service name fields can change between authentication requests, which is valid behavior. However, russh incorrectly retains authentication state such as remaining authentication methods, partial-success state, and in-progress method state across these changes. This causes an internal state mismatch where authentication information from one user or service request can improperly influence another.

This flaw was fixed in version 0.61.0 of russh.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect authentication behavior where authentication state from one user or service request affects another. This could potentially allow an attacker to bypass certain authentication checks or cause confusion in the authentication process.

The CVSS score of 5.3 indicates a medium severity impact, with no confidentiality or availability impact but with integrity impact. This means the vulnerability could allow unauthorized modification or influence of authentication state, potentially leading to unauthorized access or privilege escalation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the russh server library to version 0.61.0 or later, where the issue has been patched.

Useful 0 Not Useful 0