What’s Vulnerable › Vulnerabilities
CVE-2019-6109
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-01-31 · updated 2026-10-14
- Weakness: CWE-116
Description
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Affected products
- Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
- Debian Linux: 8.0, 9.0
- Fedoraproject Fedora: 30
- Fujitsu M10-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- Fujitsu M10-4 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- Fujitsu M10-4S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- Fujitsu M12-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- Fujitsu M12-2 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- Fujitsu M12-2S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
- NetApp Element Software: all versions
- NetApp Ontap Select Deploy: all versions
- NetApp Storage Automation Store: all versions
- OpenSSH: through 7.9
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6
- RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
- RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6
- Siemens Scalance X204Rna Eec Firmware: before 3.2.7 — fixed in 3.2.7
- Siemens Scalance X204Rna Firmware: before 3.2.7 — fixed in 3.2.7
- Winscp: through 5.13
How to fix
Upgrade to a fixed version: Fujitsu M10-1 Firmware xcp2361, xcp3070; Fujitsu M10-4 Firmware xcp2361, xcp3070; Fujitsu M10-4S Firmware xcp2361, xcp3070; Fujitsu M12-1 Firmware xcp2361, xcp3070; Fujitsu M12-2 Firmware xcp2361, xcp3070; Fujitsu M12-2S Firmware xcp2361, xcp3070; Siemens Scalance X204Rna Eec Firmware 3.2.7; Siemens Scalance X204Rna Firmware 3.2.7. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html
- https://access.redhat.com/errata/RHSA-2019:3702
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
- https://security.gentoo.org/glsa/201903-16
- https://security.netapp.com/advisory/ntap-20190213-0001/
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://usn.ubuntu.com/3885-1/
- https://www.debian.org/security/2019/dsa-4387
Get alerted when CVE-2019-6109 or the next vulnerability affects your stack