{"id":"CVE-2019-6109","aliases":["ALPINE-CVE-2019-6109","BELL-CVE-2019-6109","CLSA-2022-1671481111","CLSA-2022-1671481339","CLSA-2025-1754941200","CLSA-2026-1774528369","CLSA-2026-1774528630","DEBIAN-CVE-2019-6109","DLA-1728-1","DSA-4387-1","EUVD-2019-15676","GHSA-2pqm-q853-jfvf","MGASA-2019-0156","RHSA-2019:3702","RLSA-2019:3702","SUSE-SU-2019:0125-1","SUSE-SU-2019:0125-2","SUSE-SU-2019:0126-1","SUSE-SU-2019:0132-1","SUSE-SU-2019:0496-1","SUSE-SU-2019:0941-1","SUSE-SU-2019:13931-1","SUSE-SU-2019:14016-1","SUSE-SU-2019:14030-1","SUSE-SU-2019:1524-1","UBUNTU-CVE-2019-6109","USN-3885-1","openSUSE-SU-2019:0091-1","openSUSE-SU-2019:0307-1","openSUSE-SU-2024:11124-1"],"status":"published","title":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03807,"percentile":0.90104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2019-01-14T00:00:00Z","modified":"2026-10-24T10:31:02Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"openssh","fixed_in":["7.5_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openssh","fixed_in":["7.5_p1-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.9p1-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.9p1-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.9p1-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.fips.2.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.fips.2.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openssh","fixed_in":["1:7.6p1-4ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3p1-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-125.el6.tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-6"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u8"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4","1:6.7p1-5+deb8u5","1:6.7p1-5+deb8u6","1:6.7p1-5+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.4p1-10+deb9u5"}]}],"versions":["1:7.4p1-10","1:7.4p1-10+deb9u1","1:7.4p1-10+deb9u2","1:7.4p1-10+deb9u3","1:7.4p1-10+deb9u4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5p1-2.4.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-30.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.12"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.7"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.8.1"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2.3","1:7.2p2-4ubuntu2.fips.2.4.1","1:7.2p2-4ubuntu2.fips.2.4.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.10.1"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2","1:7.2p2-4ubuntu2.fips.2.2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.2"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.12"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.7"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.2"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-lp150.8.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-lp150.8.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-7.4"}]}],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fujitsu","product":"m10-1_firmware"},{"vendor":"fujitsu","product":"m10-4_firmware"},{"vendor":"fujitsu","product":"m10-4s_firmware"},{"vendor":"fujitsu","product":"m12-1_firmware"},{"vendor":"fujitsu","product":"m12-2_firmware"},{"vendor":"fujitsu","product":"m12-2s_firmware"},{"vendor":"netapp","product":"element_software"},{"vendor":"netapp","product":"ontap_select_deploy"},{"vendor":"netapp","product":"storage_automation_store"},{"vendor":"openbsd","product":"openssh"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"siemens","product":"scalance_x204rna_eec_firmware"},{"vendor":"siemens","product":"scalance_x204rna_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"winscp","product":"winscp"}],"references":[{"url":"https://www.debian.org/security/2019/dsa-4387","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3885-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","tags":["x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://security.gentoo.org/glsa/201903-16","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","tags":["vendor-advisory","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","tags":["vendor-advisory","x_transferred","Broken Link","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3702","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-412672.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6109","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G"},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001"},{"url":"https://usn.ubuntu.com/3885-1"},{"url":"https://github.com/advisories/GHSA-2pqm-q853-jfvf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-6109","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-6109","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1671481111.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1671481339.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1754941200.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1774528369.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1774528630.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6109","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24308","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1707485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732449","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3702.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20685","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6109","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:3702","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121571","tags":["report"]},{"url":"https://bugzilla.suse.com/1121816","tags":["report"]},{"url":"https://bugzilla.suse.com/1121818","tags":["report"]},{"url":"https://bugzilla.suse.com/1121821","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6111","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190125-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190126-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190132-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125687","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190941-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1090671","tags":["report"]},{"url":"https://bugzilla.suse.com/1115550","tags":["report"]},{"url":"https://bugzilla.suse.com/1119183","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914016-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131709","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914030-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6109","tags":["report"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037459.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3885-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-20685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6111","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2MNLMLCJQ4RNIHX2VZUWA6ZK3G7XMXKU/#2MNLMLCJQ4RNIHX2VZUWA6ZK3G7XMXKU","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S63AIPCO4O55HWF7CTXNRODVU5X3HLUD/#S63AIPCO4O55HWF7CTXNRODVU5X3HLUD","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8858","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T00:00:00Z","modified":"2026-10-14T06:40:21.079Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-15676","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T00:00:00Z","modified":"2026-10-14T06:40:21Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-2pqm-q853-jfvf","title":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2022-05-13T01:22:34Z","modified":"2026-10-14T09:32:18Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T18:29:00.71Z","modified":"2026-10-14T07:16:55.607Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T18:29:00.71Z","modified":"2026-09-21T06:17:52.528946023Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2019-6109","title":"CVE-2019-6109 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:19.428979Z","modified":"2026-01-26T09:49:48.573021Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T18:29:00.71Z","modified":"2026-10-24T10:31:02.240016329Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-31T18:29:00.71Z","modified":"2026-10-15T07:47:37.195560103Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2019:3702","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:36:25Z","modified":"2026-06-26T12:22:04.141441972Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RLSA-2019:3702","title":"Moderate: openssh security, bug fix, and enhancement update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nThe following packages have been upgraded to a later upstream version: openssh (8.0p1). (BZ#1691045)\n\nSecurity Fix(es):\n\n* openssh: scp client improper directory name validation (CVE-2018-20685)\n\n* openssh: Improper validation of object names allows malicious server to overwrite files via scp client (CVE-2019-6111)\n\n* openssh: Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.","status":"published","published":"2026-07-30T06:00:52.146294Z","modified":"2026-07-30T06:30:05.226813649Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-6109","description":"An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.","status":"published","published":"2019-01-14T00:00:00Z","modified":"2026-10-05T19:19:34.592961995Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"CLSA-2022-1671481111","title":"openssh: Fix of 2 CVEs","description":"- CVE-2019-6109: verify character encoding in progress display to avoid\n  spoofing of scp client output\n- CVE-2016-10012: updated to fix server-side protocol errors observed\n  during rekeying with compression enabled","status":"published","published":"2022-12-19T20:18:31Z","modified":"2026-10-21T10:48:01.965499497Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1671481339","title":"openssh: Fix of 2 CVEs","description":"- CVE-2019-6109: verify character encoding in progress display to avoid\n  spoofing of scp client output\n- CVE-2016-10012: updated to fix server-side protocol errors observed\n  during rekeying with compression enabled","status":"published","published":"2022-12-19T20:22:19Z","modified":"2026-10-21T10:47:17.240096272Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2025-1754941200","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2025-08-11T19:40:04Z","modified":"2026-06-01T00:33:18.023627805Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1774528369","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2026-03-26T12:32:54Z","modified":"2026-06-01T00:33:27.102665332Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774528630","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2026-03-26T12:37:14Z","modified":"2026-06-01T00:33:28.163109261Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"DLA-1728-1","title":"openssh - security update","status":"published","published":"2019-03-25T00:00:00Z","modified":"2026-03-09T01:18:56.430992Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4387-1","title":"openssh - security update","status":"published","published":"2019-02-09T00:00:00Z","modified":"2026-03-09T02:09:14.227256Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0156","title":"Updated openssh packages fix security vulnerabilities","description":"Updated openssh packages fix security vulnerabilities:\n\nDue to missing character encoding in the progress display, the object\nname can be used to manipulate the client output, for example to employ\nANSI codes to hide additional files being transferred (CVE-2019-6109).\n\nDue to scp client insufficient input validation in path names sent by\nserver, a malicious server can do arbitrary file overwrites in target\ndirectory. If the recursive (-r) option is provided, the server can\nalso manipulate subdirectories as well (CVE-2019-6111).\n\nThe check added in this version can lead to regression if the client and\nthe server have differences in wildcard expansion rules. If the server is\ntrusted for that purpose, the check can be disabled with a new -T option\nto the scp client.\n","status":"published","published":"2019-05-12T09:35:33Z","modified":"2026-04-16T04:40:56.223929907Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0091-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:50:30Z","modified":"2026-02-04T02:56:13.320746Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0307-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816)\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821)\n\nOther bug fixes and changes:\n\n- Handle brace expansion in scp when checking that filenames sent\n  by the server side match what the client requested (bsc#1125687)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:09:55Z","modified":"2026-02-04T03:06:10.344023Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11124-1","title":"openssh-8.4p1-7.4 on GA media","description":"These are all security issues fixed in the openssh-8.4p1-7.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:55.290754Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0125-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T13:19:17Z","modified":"2026-02-04T03:48:29.434241Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0125-2","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-04-29T06:02:04Z","modified":"2026-02-04T03:12:47.898735Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0126-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T13:19:59Z","modified":"2025-05-02T04:08:09.668344Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0132-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-21T08:35:19Z","modified":"2026-02-04T02:45:17.180098Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0496-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816)\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821)\n\nOther bug fixes and changes:\n\n- Handle brace expansion in scp when checking that filenames sent\n  by the server side match what the client requested (bsc#1125687)\n","status":"published","published":"2019-02-26T15:43:14Z","modified":"2026-02-04T03:50:07.534405Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0941-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\n","status":"published","published":"2019-04-12T13:58:12Z","modified":"2026-02-04T02:38:31.451313Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13931-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T15:30:38Z","modified":"2026-02-04T02:24:51.498539Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:14016-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\t  \n","status":"published","published":"2019-04-11T14:06:33Z","modified":"2026-02-04T04:05:22.868092Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:14030-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\t  \n","status":"published","published":"2019-04-25T08:34:53Z","modified":"2026-02-04T03:02:11.075166Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1524-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed a double free() in the KDF CAVS testing tool (bsc#1065237).\n","status":"published","published":"2019-06-17T15:30:39Z","modified":"2026-02-04T02:32:21.447393Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3885-1","title":"openssh vulnerabilities","description":"Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a\nuser or automated system were tricked into connecting to an untrusted\nserver, a remote attacker could possibly use these issues to write to\narbitrary files, change directory permissions, and spoof client output.\n","status":"published","published":"2019-02-07T18:50:47Z","modified":"2026-05-29T18:00:34.739013599Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}