[dependabot]

Bumps russh from 0.63.3 to 0.64.1.

Release notes

Sourced from russh's releases.

v0.64.1

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

v0.64.0

Breaking changes

• 5d9d2b8: drop the legacy ed25519 key parser
  • Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

• efa9a03: Add support hostkeys-prove-00@openssh.com support (#767) (@​inureyes) #767

  • Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via hostkeys-00@openssh.com.

• a0ded76: Support sending custom global requests from the client (#759) (@​ChrisJr404) #759

  • Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

• e8b2fd3: Fix enforce rekey read and time limits (#766) (@​inureyes) #766
• bf05d50: honor want_reply = false on server-side global requests
• dddf72c: bug: Fix partial_success clobber (#773) (@​markovejnovic) #773
• 26487fb: fix: auth-agent-req@openssh.com replies on channel (#774) (#775) (@​markovejnovic) #775
• 36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@​t8y2) #779

New Contributors

• @​markovejnovic made their first contribution in Eugeny/russh#773
• @​t8y2 made their first contribution in Eugeny/russh#779
• @​ChrisJr404 made their first contribution in Eugeny/russh#759

Full Changelog: Eugeny/russh@v0.63.3...v0.64.0

Commits

• e5d80a0 v0.64.1
• 4c30503 handle lifetime constraints correctly
• c0fe3b1 bump pageant
• 4973149 v0.64.0
• bf05d50 cleanup
• a0ded76 Support sending custom global requests from the client (#759)
• e8b2fd3 Fix enforce rekey read and time limits (#766)
• efa9a03 Add support hostkeys-prove-00@openssh.com (#767)
• 36fa1bc fix(pageant): trim username padding and handle empty principals (#779)
• d27ff7e add t8y2 as a contributor for code (#780)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[kipavy]

Superseded by #663, which landed the same bump on dev.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.