Vulnerability DatabaseCVE-2019-6109
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2019-6109
January 31, 2019
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Related Resources (18)
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
https://security-tracker.debian.org/tracker/CVE-2019-6109
https://people.canonical.com/~ubuntu-security/cve/CVE-2019-6109
https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://www.debian.org/security/2019/dsa-4387
https://security.netapp.com/advisory/ntap-20190213-0001/
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html
https://access.redhat.com/security/cve/CVE-2019-6109
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
https://security.gentoo.org/glsa/201903-16
https://security.alpinelinux.org/vuln/CVE-2019-6109
https://access.redhat.com/errata/RHSA-2019:3702
https://usn.ubuntu.com/3885-1/
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.6
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
ATTACKED
CVSS v3
Base Score:
6.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Exploit Maturity
HIGH
CVSS v2
Base Score:
4
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
Weakness Type (CWE)
Improper Encoding or Escaping of Output
CWE-116
EPSS
Base Score:
9.74