CVE-2019-6110
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this OpenSSH vulnerability?
The vulnerability ID of this OpenSSH vulnerability is CVE-2019-6110.
What is the severity rating of CVE-2019-6110?
CVE-2019-6110 has a severity rating of 6.8 (medium).
Which software versions are affected by CVE-2019-6110?
The affected software versions include OpenSSH 7.9, WinSCP 5.13, Netapp Element Software, Netapp Ontap Select Deploy, and Netapp Storage Automation Store.
How can a malicious server exploit CVE-2019-6110?
A malicious server can exploit CVE-2019-6110 by manipulating the client output using arbitrary stderr output, for example, by using ANSI control codes to hide additional files being transferred.
Where can I find more information about CVE-2019-6110?
You can find more information about CVE-2019-6110 at the following references: [Reference 1](https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf), [Reference 2](https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c), [Reference 3](https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c).