CVE-2019-6109

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

Affected products

Alt Linux, Centos, Ibm Aix, Openssh, Red Hat, Suse, Ubuntu

Openbsd Openssh

≤ 7.9

Winscp

≤ 5.13

Fix

Available

CVSS 3.1

6.8 MEDIUM

EPSS

3.8% (89th percentile)

Weakness

CWE-116

NVD status

Modified

Published

2019-01-31

No exploit for CVE-2019-6109 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.