CVE-2023-28113

Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality.

Details

Russh does not validate Diffie-Hellman keys.

It accepts received DH public keys $e$ where $e<0$, $e=1$, or $e \geq p-1$ from a misbehaving peer annd successfully performs key exchange.

This is a violation of RFC 4253, section 8 and RFC 8268, section 4, which state that:

DH Public Key values MUST be checked and both conditions:

• $1 < e < p-1$
• $1 < f < p-1$

MUST be true. Values not within these bounds MUST NOT be sent or
accepted by either side. If either one of these conditions is
violated, then the key exchange fails.

For example, a DH client public key $e=1$ would mean that the shared secret that the server calculates is always $K = e^y \mod{p} = 1^y \mod{p} = 1$.
In other cases, an insecure order-2 subgroup may be used.

Also, the code does not look like it ensures that the generated secret key $y$ is in the valid interval $0 < y < q$ (or, if russh is the client, that the secret key $x$ satisfies $1 < x < q$):
https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76
For example, rng.gen_biguint() might return a number consisting of zeroes, so that $y = 0$.

The public key is not validated either:
https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81

Due to the issues in the DH key generation, I think any connection that uses Diffie-Hellman key exchange is affected.
Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping.

Most other implementations reject such keys, so this is mainly an interoperability issue in such a case.

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

CVE-2023-28113 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.36.2, 0.37.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2023-28113? CVE-2023-28113 is a medium-severity improper input validation vulnerability in russh (rust), affecting versions < 0.36.2. It is fixed in 0.36.2, 0.37.1. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. How severe is CVE-2023-28113? CVE-2023-28113 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of russh are affected by CVE-2023-28113? russh (rust) versions < 0.36.2 is affected.
4. Is there a fix for CVE-2023-28113? Yes. CVE-2023-28113 is fixed in 0.36.2, 0.37.1. Upgrade to this version or later.
5. Is CVE-2023-28113 exploitable, and should I be worried? Whether CVE-2023-28113 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-28113 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-28113?
   • Upgrade russh to 0.36.2 or later
   • Upgrade russh to 0.37.1 or later