{"action":"Upgrade russh to 0.36.2 or later.","affected":[{"fixed":"0.36.2","introduced":"0"},{"fixed":"0.37.1","introduced":"0.37.0"}],"component":"russh","cve_ids":["CVE-2023-28113"],"ecosystem":"crates.io","epss":0.00638,"exploited":false,"fixed_versions":["0.36.2","0.37.1"],"ghsa_id":"GHSA-cqvm-j2r2-hwpg","id":"tcs_01M5KEX08SWYS2HFN62B94XRXH","modified_at":"2023-11-08T04:12:08.989289Z","published_at":"2023-03-17T14:42:45Z","references":["https://osv.dev/vulnerability/GHSA-cqvm-j2r2-hwpg","https://github.com/warp-tech/russh/security/advisories/GHSA-cqvm-j2r2-hwpg","https://nvd.nist.gov/vuln/detail/CVE-2023-28113","https://github.com/warp-tech/russh/commit/45d2d82930bf4a675bd57abfafec8fe4065befcd","https://github.com/warp-tech/russh/commit/d831a3716d3719dc76f091fcea9d94bd4ef97c6e","https://github.com/warp-tech/russh","https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76","https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81","https://github.com/warp-tech/russh/releases/tag/v0.36.2","https://github.com/warp-tech/russh/releases/tag/v0.37.1"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-cqvm-j2r2-hwpg","url":"https://osv.dev/vulnerability/GHSA-cqvm-j2r2-hwpg"}],"summary":"russh may use insecure Diffie-Hellman keys"}