Vulnerability Details : CVE-2019-6109

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

Published 2019-01-31 18:29:01

Updated 2023-02-23 23:16:52

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-6109

Probability of exploitation activity in the next 30 days: 0.15%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 50 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-6109

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.0	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:N	4.9	4.9	[email protected]
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	1.6	5.2	[email protected]
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2019-6109

CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Assigned by: [email protected] (Primary)

References for CVE-2019-6109

https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c

Release Notes;Vendor Advisory

CVEs referencing this url
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Third Party Advisory

CVEs referencing this url
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Patch;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20190213-0001/

Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/201903-16

Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html

Broken Link

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/[email protected]/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/

Mailing List;Third Party Advisory

CVEs referencing this url
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c

Release Notes;Vendor Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3702

Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/3885-1/

Third Party Advisory

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Patch;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html

Mailing List;Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2019/dsa-4387

Third Party Advisory

CVEs referencing this url

Products affected by CVE-2019-6109

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 8.1
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 8.2
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 8.4
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 8.6
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 8.2
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 8.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 8.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 8.2
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 8.4
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 8.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
Matching versions
Openbsd » Openssh
Versions up to, including, (<=) 7.9
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Matching versions
Siemens » Scalance X204rna Firmware
Versions before (<) 3.2.7
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204rna » Version: N/A
Siemens » Scalance X204rna Eec Firmware
Versions before (<) 3.2.7
cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204rna Eec » Version: N/A
Fujitsu » M10-1 Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-1 » Version: N/A
Fujitsu » M10-1 Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-1 » Version: N/A
Fujitsu » M10-4 Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-4 » Version: N/A
Fujitsu » M10-4 Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-4 » Version: N/A
Fujitsu » M10-4s Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-4s » Version: N/A
Fujitsu » M10-4s Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M10-4s » Version: N/A
Fujitsu » M12-1 Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-1 » Version: N/A
Fujitsu » M12-1 Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-1 » Version: N/A
Fujitsu » M12-2 Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-2 » Version: N/A
Fujitsu » M12-2 Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-2 » Version: N/A
Fujitsu » M12-2s Firmware
Versions before (<) xcp3070
cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-2s » Version: N/A
Fujitsu » M12-2s Firmware
Versions before (<) xcp2361
cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » M12-2s » Version: N/A
Winscp » Winscp
Versions up to, including, (<=) 5.13
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Matching versions
Netapp » Element Software » Version: N/A
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Matching versions
Netapp » Ontap Select Deploy » Version: N/A
cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*
Matching versions
Netapp » Storage Automation Store » Version: N/A
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
Matching versions