⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2019-6109 — Improper Encoding or Escaping of Output in Openssh

CWE-116 — Improper Encoding or Escaping of OutputCWE-451 — User Interface (UI) Misrepresentation of Critical Information11 documents10 sources
Severity
6.8MEDIUMNVD
EPSS
9.7%
top 7.05%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
18
Openbsd OpensshFujitsu M10-1 FirmwareFujitsu M10-4 Firmware+15 more
Timeline
PublishedJan 31
Latest updateApr 5

Description

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.2

Affected Packages12 packages

▶Debianopenbsd/openssh< 1:7.9p1-6+3
▶NVDfujitsu/m10-1_firmware< xcp2361+1
▶NVDfujitsu/m10-4_firmware< xcp2361+1
▶NVDfujitsu/m12-1_firmware< xcp2361+1

Also affects: Debian Linux 8.0, 9.0, Fedora 30, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 8.0, 8.1, 8.2, 8.4, 8.6

Patches

Patch: cert-portal.siemens.com ↗Patch: www.oracle.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-2pqm-q853-jfvf: An issue was discovered in OpenSSH 7↗2022-05-13
▶
OSV
CVE-2019-6109: An issue was discovered in OpenSSH 7↗2019-01-31
▶
CVEList
CVE-2019-6109: An issue was discovered in OpenSSH 7↗2019-01-31
▶
VulnCheck
OpenBSD openssh Improper Encoding or Escaping of Output↗2019
▶

📋Vendor Advisories

4
Palo Alto
PAN-SA-2024-0003 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION↗2024-04-05
▶
Ubuntu
OpenSSH vulnerabilities↗2019-02-07
▶
Debian
CVE-2019-6109: openssh - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the...↗2019
▶
Red Hat
openssh: Missing character encoding in progress display allows for spoofing of scp client output↗2018-11-16
▶

💬Community

2
Bugzilla
CVE-2019-6109 openssh: Missing character encoding in progress display allows for spoofing of scp client output [fedora-all]↗2019-01-15
▶
Bugzilla
CVE-2019-6109 openssh: Missing character encoding in progress display allows for spoofing of scp client output↗2019-01-15
▶
CVE-2019-6109 — Improper Encoding or Escaping of Output | cvebase