• c13b259: enforce inactivity timeout even during stalled writes (Eugene)

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

An authenticated client could trigger unbounded memory allocation during rekey phase

• client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
• 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
• b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
• 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
• a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
• 422123c: dedup zlib compress loop into compress_into (Eugene)

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

• 09f6582: Support host certificates on the client side (#752) (@biao29) #752

  • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

  • Adds a Config::certificates that functions similarly to Config::keys

• f2354c7: improve strict kex checks (Eugene)
• 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
• 46c927a: use constant-time comparison for agent unlock (Eugene)
• 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: https://github.com/Eugeny/russh/compare/v0.62.7...v0.63.0

• 09f6582: Support host certificates on the client side (#752) (@biao29) #752
• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

Full Changelog: https://github.com/Eugeny/russh/compare/v0.62.7...v0.63.0-beta.1

• client: support gssapi-with-mic auth (#738) #738 (ayamir)

• don't truncate decompressed packets that expand more than 2x (#750) #750 (Luiz Ribeiro)
• c9da80c: Pageant WM_COPYDATA protocol fix & token tightening (#624) (vzex) #624
• fall back to GetUserNameA when GetUserNameExA fails (#726) #726 (cwatanab)

Config::max_auth_attempts was not being properly enforced by russh server implementation.

• c66837e: Fix deadlock when handling open channel on contended handler (#734) (Eric Rodrigues Pires) #734

• c465e3f: accept a single trailing comma in SSH name-lists (#743) (PokAhonTAS911) #743
• add Motor OS support (#742) #742 (lasiotus)

Russh server did not validate channel IDs passed by a client, so if a client constructed a channel message with an invalid ID, the server-side Handler callback would still get called with that non-existing ID. The consequence of this depend on the specific user implementation.

• de96ad1: fixed #725 - add backpressure to Channel::data() (Eugene)

Full Changelog: https://github.com/Eugeny/russh/compare/v0.62.4...v0.62.5

Three independent bugs have allowed a client to trigger a panic in the session handler task, thereby crashing their own session.

• GHSA-cqjc-rmpq-xprq: sending a malformed PTY request packet - 8912512
• GHSA-g9hv-x236-4qp3: sending a malformed Curve25519 KEX packet - a7fc1eb
• GHSA-5xvq-cp9x-6p6r: sending a zero Curve25519 key - a7fc1eb

• russh: bump russh-sftp dev-dependency 2.1.0 → 2.3.0 (#728) #728 (Sion Kang)

• 2e3f1cc: Update more RustCrypto dependencies to stabilized versions (#735) (kpcyrd) [#735]