CVE-2019-6109
Description
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Fedora Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| 30 | Affected | — |
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Ubuntu Affected 4 releases
| Version | Status | Fixed in |
|---|---|---|
| 18.10 | Affected | — |
| 18.04 | Affected | — |
| 16.04 | Affected | — |
| 14.04 | Affected | — |
Debian Mixed 7 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 1:7.9p1-6 |
| sid | Fixed | 1:7.9p1-6 |
| forky | Fixed | 1:7.9p1-6 |
| bullseye | Fixed | 1:7.9p1-6 |
| bookworm | Fixed | 1:7.9p1-6 |
| 9.0 | Affected | — |
| 8.0 | Affected | — |
Red Hat Mixed 6 releases
| Version | Status | Fixed in |
|---|---|---|
| 8.6 | Affected | — |
| 8.4 | Affected | — |
| 8.2 | Affected | — |
| 8.1 | Affected | — |
| 8.0 | Affected | — |
| 8 | Fixed | — |
Arch Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Fixed | 8.0p1-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openbsd | openssh | {"endIncluding":"7.9"} | |
| winscp | winscp | {"endIncluding":"5.13"} | |
| netapp | element_software | - | |
| netapp | ontap_select_deploy | - | |
| netapp | storage_automation_store | - | |
| siemens | scalance_x204rna | - | |
| siemens | scalance_x204rna_eec | - | |
| fujitsu | m10-1 | - | |
| fujitsu | m10-4 | - | |
| fujitsu | m10-4s | - | |
| fujitsu | m12-1 | - | |
| fujitsu | m12-2 | - | |
| fujitsu | m12-2s | - | |
References
- https://security.archlinux.org/ASA-201904-11
- https://www.suse.com/security/cve/CVE-2019-6109.html
- https://security-tracker.debian.org/tracker/CVE-2019-6109
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html
- https://access.redhat.com/errata/RHSA-2019:3702
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
- https://security.gentoo.org/glsa/201903-16
- https://security.netapp.com/advisory/ntap-20190213-0001/
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://usn.ubuntu.com/3885-1/
- https://www.debian.org/security/2019/dsa-4387
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
CWEs
CWE-116
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.