{"id":"CVE-2019-6111","title":"An issue was discovered in OpenSSH 7.9","summary":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-22","CWE-22"],"vendor":"openbsd","product":"openssh","affected":["openssh <= 7.9","winscp <= 5.1.3","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 18.10","debian_linux = 8.0","debian_linux = 9.0","enterprise_linux = 7.0","enterprise_linux = 8.0","enterprise_linux_eus = 8.1","enterprise_linux_eus = 8.2","enterprise_linux_eus = 8.4","enterprise_linux_eus = 8.6","enterprise_linux_server_aus = 8.2","enterprise_linux_server_aus = 8.4","enterprise_linux_server_aus = 8.6","enterprise_linux_server_tus = 8.2","enterprise_linux_server_tus = 8.4","enterprise_linux_server_tus = 8.6","fedora = 30","mina_sshd = 2.2.0","freebsd < 12.0","freebsd = 12.0","m10-1_firmware < xcp2361","m10-4_firmware < xcp2361","m10-4s_firmware < xcp2361","m12-1_firmware < xcp2361","m12-2_firmware < xcp2361","m12-2s_firmware < xcp2361","m10-1_firmware < xcp3070","m10-4_firmware < xcp3070","m10-4s_firmware < xcp3070","m12-1_firmware < xcp3070","m12-2_firmware < xcp3070","m12-2s_firmware < xcp3070","scalance_x204rna_firmware < 3.2.7","scalance_x204rna_eec_firmware < 3.2.7"],"patched":["freebsd 12.0","m10-1_firmware xcp3070","m10-4_firmware xcp3070","m10-4s_firmware xcp3070","m12-1_firmware xcp3070","m12-2_firmware xcp3070","m12-2s_firmware xcp3070","scalance_x204rna_firmware 3.2.7","scalance_x204rna_eec_firmware 3.2.7"],"published":"2019-01-31","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:56.120","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/04/18/1","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2022/08/02/1","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/106741","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3702","label":"cve@mitre.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677794","label":"cve@mitre.org"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","label":"cve@mitre.org"},{"url":"https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201903-16","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001/","label":"cve@mitre.org"},{"url":"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3885-1/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3885-2/","label":"cve@mitre.org"},{"url":"https://www.debian.org/security/2019/dsa-4387","label":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/46193/","label":"cve@mitre.org"},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","label":"cve@mitre.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2019/04/18/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2022/08/02/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/106741","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3702","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677794","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201903-16","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3885-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3885-2/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4387","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/46193/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-412672.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","exploit-available"],"epss":0.58204,"epssPercentile":0.99079,"exploits":{"exploitdb":true,"github":2,"githubRepos":["https://github.com/53n7hu/SNP","https://github.com/mbadanoiu/MAL-008"],"checkedAt":"2026-10-14T07:21:40.622Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T07:21:04.805Z","slug":"CVE-2019-6111","body":"## Overview\n\nAn issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).\n\n## Affected\n\n- `openssh <= 7.9`\n- `winscp <= 5.1.3`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 18.10`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `enterprise_linux = 7.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux_eus = 8.1`\n- `enterprise_linux_eus = 8.2`\n- `enterprise_linux_eus = 8.4`\n- `enterprise_linux_eus = 8.6`\n- `enterprise_linux_server_aus = 8.2`\n- `enterprise_linux_server_aus = 8.4`\n- `enterprise_linux_server_aus = 8.6`\n- `enterprise_linux_server_tus = 8.2`\n- `enterprise_linux_server_tus = 8.4`\n- `enterprise_linux_server_tus = 8.6`\n- `fedora = 30`\n- `mina_sshd = 2.2.0`\n- `freebsd < 12.0`\n- `freebsd = 12.0`\n- `m10-1_firmware < xcp2361`\n- `m10-4_firmware < xcp2361`\n- `m10-4s_firmware < xcp2361`\n- `m12-1_firmware < xcp2361`\n- `m12-2_firmware < xcp2361`\n- `m12-2s_firmware < xcp2361`\n- `m10-1_firmware < xcp3070`\n- `m10-4_firmware < xcp3070`\n- `m10-4s_firmware < xcp3070`\n- `m12-1_firmware < xcp3070`\n- `m12-2_firmware < xcp3070`\n- `m12-2s_firmware < xcp3070`\n- `scalance_x204rna_firmware < 3.2.7`\n- `scalance_x204rna_eec_firmware < 3.2.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `freebsd 12.0`\n- `m10-1_firmware xcp3070`\n- `m10-4_firmware xcp3070`\n- `m10-4s_firmware xcp3070`\n- `m12-1_firmware xcp3070`\n- `m12-2_firmware xcp3070`\n- `m12-2s_firmware xcp3070`\n- `scalance_x204rna_firmware 3.2.7`\n- `scalance_x204rna_eec_firmware 3.2.7`","depth":"twilight","depthScore":56,"depthScoreParts":{"impact":32.5,"likelihood":11.6,"exploitation":12,"ransomware":0},"changes":[]}