CVE-2019-6109Medium· 6.8▾ SunlitAn issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.8%
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
openssh <= 7.9winscp <= 5.13ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 18.10debian_linux = 8.0debian_linux = 9.0element_softwareontap_select_deploystorage_automation_storefedora = 30enterprise_linux = 8.0enterprise_linux_eus = 8.1enterprise_linux_eus = 8.2enterprise_linux_eus = 8.4enterprise_linux_eus = 8.6enterprise_linux_server_aus = 8.2enterprise_linux_server_aus = 8.4enterprise_linux_server_aus = 8.6enterprise_linux_server_tus = 8.2enterprise_linux_server_tus = 8.4enterprise_linux_server_tus = 8.6scalance_x204rna_firmware < 3.2.7scalance_x204rna_eec_firmware < 3.2.7m10-1_firmware < xcp2361m10-4_firmware < xcp2361m10-4s_firmware < xcp2361m12-1_firmware < xcp2361m12-2_firmware < xcp2361m12-2s_firmware < xcp2361m10-1_firmware < xcp3070m10-4_firmware < xcp3070m10-4s_firmware < xcp3070m12-1_firmware < xcp3070m12-2_firmware < xcp3070m12-2s_firmware < xcp3070Upgrade past the affected range:
scalance_x204rna_firmware 3.2.7scalance_x204rna_eec_firmware 3.2.7m10-1_firmware xcp3070m10-4_firmware xcp3070m10-4s_firmware xcp3070m12-1_firmware xcp3070m12-2_firmware xcp3070m12-2s_firmware xcp3070Connected by shared product, vendor, weakness, or advisory.
CVE-2019-16905High· 7.8OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key
CVE-2019-6110Medium· 6.8In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files …
CVE-2019-6111Medium· 5.9An issue was discovered in OpenSSH 7.9
CVE-2020-15778High· 7.4scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument
CVE-2020-14145Medium· 5.9The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation
CVE-2020-12062High· 7.5The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download di…