CVE-2019-6109
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
- CVSS 3.1
- 6.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - EPSS
- 3.8% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-25)
- CWE
- CWE-116
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- fedoraproject:fedora
- fujitsu:m10-1_firmware
- fujitsu:m10-4_firmware
- fujitsu:m10-4s_firmware
- fujitsu:m12-1_firmware
- fujitsu:m12-2_firmware
- fujitsu:m12-2s_firmware
- netapp:element_software
- netapp:ontap_select_deploy
- netapp:storage_automation_store
- openbsd:openssh
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- siemens:scalance_x204rna_eec_firmware
- siemens:scalance_x204rna_firmware
- winscp:winscp