{"cve":"CVE-2023-28113","nvd":{"published":"2023-03-16T21:15:13.360","modified":"2026-06-17T05:46:54.000","status":"Modified","description":"russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-347","CWE-20","CWE-358"],"references":["https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76","https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81","https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e","https://github.com/warp-tech/russh/releases/tag/v0.36.2","https://github.com/warp-tech/russh/releases/tag/v0.37.1"],"products":["russh_project:russh"],"source":"nvd","synced_at":"2026-10-19T21:37:41.955480748+00:00"},"epss":{"cve":"CVE-2023-28113","score":0.00638,"percentile":0.50592,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-cqvm-j2r2-hwpg","url":"https://osv.dev/vulnerability/GHSA-cqvm-j2r2-hwpg","summary":"russh may use insecure Diffie-Hellman keys","modified":"2023-11-08T04:12:08.989289Z","packages":[{"ecosystem":"crates.io","name":"russh","purl":"pkg:cargo/russh","ranges":["<0.36.2"],"fixed":["0.36.2"]},{"ecosystem":"crates.io","name":"russh","purl":"pkg:cargo/russh","ranges":[">=0.37.0 <0.37.1"],"fixed":["0.37.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}