CVE-2019-6110

NameCVE-2019-6110
DescriptionIn OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssh (PTS)buster1:7.9p1-10+deb10u2vulnerable
buster (security)1:7.9p1-10+deb10u4vulnerable
bullseye (security), bullseye1:8.4p1-5+deb11u3vulnerable
bookworm, bookworm (security)1:9.2p1-2+deb12u2vulnerable
trixie1:9.6p1-4vulnerable
sid1:9.7p1-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensshsource(unstable)(unfixed)unimportant

Notes

https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Not considered a vulnerability by upstream, cf.
https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037475.html

Search for package or bug name: Reporting problems