CVE-2019-6110
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
31/01/2019
Last modified:
23/02/2023
Description
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
Impact
Base Score 3.x
6.80
Severity 3.x
MEDIUM
Base Score 2.0
4.00
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* | 7.9 (including) | |
| cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* | 5.13 (including) | |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:* | 3.2.7 (excluding) | |
| cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:* | 3.2.7 (excluding) | |
| cpe:2.3:h:siemens:scalance_x204rna_eec:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
- https://security.gentoo.org/glsa/201903-16
- https://security.netapp.com/advisory/ntap-20190213-0001/
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://www.exploit-db.com/exploits/46193/