[dependabot]

Bumps russh from 0.61.2 to 0.64.1.

Release notes

Sourced from russh's releases.

v0.64.1

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

v0.64.0

Breaking changes

• 5d9d2b8: drop the legacy ed25519 key parser
  • Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

• efa9a03: Add support [email protected] support (#767) (@​inureyes) #767

  • Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via [email protected].

• a0ded76: Support sending custom global requests from the client (#759) (@​ChrisJr404) #759

  • Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

• e8b2fd3: Fix enforce rekey read and time limits (#766) (@​inureyes) #766
• bf05d50: honor want_reply = false on server-side global requests
• dddf72c: bug: Fix partial_success clobber (#773) (@​markovejnovic) #773
• 26487fb: fix: [email protected] replies on channel (#774) (#775) (@​markovejnovic) #775
• 36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@​t8y2) #779

New Contributors

• @​markovejnovic made their first contribution in Eugeny/russh#773
• @​t8y2 made their first contribution in Eugeny/russh#779
• @​ChrisJr404 made their first contribution in Eugeny/russh#759

Full Changelog: Eugeny/russh@v0.63.3...v0.64.0

v0.63.3

Fixes

• c13b259: enforce inactivity timeout even during stalled writes (Eugene)

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

... (truncated)

Commits

• e5d80a0 v0.64.1
• 4c30503 handle lifetime constraints correctly
• c0fe3b1 bump pageant
• 4973149 v0.64.0
• bf05d50 cleanup
• a0ded76 Support sending custom global requests from the client (#759)
• e8b2fd3 Fix enforce rekey read and time limits (#766)
• efa9a03 Add support [email protected] (#767)
• 36fa1bc fix(pageant): trim username padding and handle empty principals (#779)
• d27ff7e add t8y2 as a contributor for code (#780)
• Additional commits viewable in compare view