ssh allows weak "null" algorithm (HMAC)

[andreasbrett]

In a vulnerability scan using gvm/openvas warpgate's ssh server on port 2222 was found to allow the weak "null" algorithm for message authentication (MAC).

Is this algorithm allowed for a reason?

russh/russh/src/negotiation.rs

Lines 72 to 80 in 5d82dcb

	const HMAC_ORDER: &[mac::Name] = &[
	mac::HMAC_SHA512_ETM,
	mac::HMAC_SHA256_ETM,
	mac::HMAC_SHA512,
	mac::HMAC_SHA256,
	mac::HMAC_SHA1_ETM,
	mac::HMAC_SHA1,
	mac::NONE,
	];