Threats tagged 'ghsa-vp5q-ff62-jwqv'

The russh SSH agent server does not call the Agent::confirm method before signing with keys added with the confirm constraint (ssh-add -c). This confirm constraint is intended to require user approval before signing. The issue was introduced in version 0.50.0-beta.12 and affects all versions up to and including 0.64.1. As a result, keys added with the confirm constraint are signed without user confirmation, allowing any process with access to the agent to use those keys without approval. This undermines the security purpose of the confirm constraint defined in RFC 9987.