chore(agent)(deps): bump russh from 0.62.6 to 0.63.3 in /catalyst-agent

[dependabot]

Bumps russh from 0.62.6 to 0.63.3.

Release notes

Sourced from russh's releases.

v0.63.3

Fixes

• c13b259: enforce inactivity timeout even during stalled writes (Eugene)

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

• client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
• 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
• b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
• 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
• a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
• 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

  • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

  • Adds a Config::certificates that functions similarly to Config::keys

Fixes

• f2354c7: improve strict kex checks (Eugene)
• 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
• 46c927a: use constant-time comparison for agent unlock (Eugene)
• 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

... (truncated)

Commits

• f33baf4 v0.63.3
• c13b259 enforce inactivity timeout if even during stalled writes
• 8a51a0d v0.63.2
• 422123c dedup zlib compress loop into compress_into
• a04e1b5 fixed #758 - fail RSA signing explicitly when RSA feature is not enabled
• af91598 fmt
• b1d3893 fixed #762 - redact sensitive data from debug logging
• a282af3 fix rekey message queueing
• 5d56698 fix read bounds in pageant
• 675b631 bump num-bigint
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: agent, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔒 Supply Chain Security Review

Check	Status
Socket.dev malware scan	✅ success
Vulnerability audit	✅ success
Lockfile diff review	✅ success
OSSF Scorecard	✅ success

This review was automatically generated by the Supply Chain Review workflow.

[github-actions]

🔒 Supply Chain Security Review

Check	Status
Socket.dev malware scan	✅ success
Vulnerability audit	✅ success
Lockfile diff review	✅ success
OSSF Scorecard	✅ success

This review was automatically generated by the Supply Chain Review workflow.