chore(deps): bump russh from 0.62.7 to 0.63.2 in the cargo group across 1 directory

[dependabot]

Bumps the cargo group with 1 update in the / directory: russh.

Updates russh from 0.62.7 to 0.63.2

Release notes

Sourced from russh's releases.

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

• client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
• 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
• b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
• 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
• a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
• 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

  • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

  • Adds a Config::certificates that functions similarly to Config::keys

Fixes

• f2354c7: improve strict kex checks (Eugene)
• 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
• 46c927a: use constant-time comparison for agent unlock (Eugene)
• 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

... (truncated)

Commits

• 8a51a0d v0.63.2
• 422123c dedup zlib compress loop into compress_into
• a04e1b5 fixed #758 - fail RSA signing explicitly when RSA feature is not enabled
• af91598 fmt
• b1d3893 fixed #762 - redact sensitive data from debug logging
• a282af3 fix rekey message queueing
• 5d56698 fix read bounds in pageant
• 675b631 bump num-bigint
• 24e2c37 fix for latest minz_oxide
• 9c86cb8 Merge branch 'main' of github.com:warp-tech/russh
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.