russhの脆弱性、ssh-add -cの確認を省いて鍵で署名される
Summary
russhのエージェントサーバーで、確認が必要な設定の鍵が確認なしで署名に使われる脆弱性が公表されました。0.50.0-beta.12から0.65.0までが対象で、CVSS v4は8.3です。修正版の0.65.0への更新が必要です。Agent::confirmで承認を求める独自の実装を使っている場合は、早めの対応をおすすめします。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
russhのエージェントサーバーで、確認が必要な設定の鍵が確認なしで署名に使われる脆弱性が公表されました。0.50.0-beta.12から0.65.0までが対象で、CVSS v4は8.3です。修正版の0.65.0への更新が必要です。Agent::confirmで承認を求める独自の実装を使っている場合は、早めの対応をおすすめします。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Eugeny | russh | — | — |
Original description The description as published by the source.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.
Source: CVE.org (CVE Program・cvelistV5) NVD