CVE-2019-6110 PUBLISHED

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

EPSS 51.29% · 97.9th percentile

Risk Scores

EPSS Score
51.29%
97.9th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSopenssh0, 1:7.6p1-4ubuntu0.7+esm4, 1:7.6p1-4ubuntu0.7+esm3
Ubuntu:18.04:LTSopenssh-ssh11:7.5p1-10, 1:7.5p1-9, 1:7.5p1-8
Ubuntu:20.04:LTSopenssh1:8.2p1-4ubuntu0.4, 1:8.2p1-4ubuntu0.2, 1:8.2p1-4ubuntu0.1
Ubuntu:Pro:16.04:LTSopenssh1:7.2p2-4ubuntu2.7, 0, 1:6.9p1-2
Ubuntu:20.04:LTSopenssh-ssh10, 1:7.5p1-11build1
Ubuntu:Pro:14.04:LTSopenssh1:6.6p1-2ubuntu2.13+esm1, 1:6.6p1-2ubuntu2.13, 1:6.6p1-2ubuntu2.12

Timeline

References

Open in Interactive Console →