{"id":"CVE-2019-6111","aliases":["ALPINE-CVE-2019-6111","BELL-CVE-2019-6111","CLSA-2025-1754941200","CLSA-2026-1774528369","CLSA-2026-1774528630","DEBIAN-CVE-2019-6111","DLA-1728-1","DSA-4387-1","DSA-4387-2","EUVD-2019-15678","GHSA-jr78-hfw4-xp7g","MGASA-2019-0156","RHSA-2019:3702","RLSA-2019:3702","SUSE-SU-2019:0125-1","SUSE-SU-2019:0125-2","SUSE-SU-2019:0126-1","SUSE-SU-2019:0132-1","SUSE-SU-2019:0496-1","SUSE-SU-2019:0941-1","SUSE-SU-2019:13931-1","SUSE-SU-2019:14016-1","SUSE-SU-2019:14030-1","SUSE-SU-2019:1524-1","UBUNTU-CVE-2019-6111","USN-3885-1","USN-3885-2","openSUSE-SU-2019:0091-1","openSUSE-SU-2019:0307-1","openSUSE-SU-2024:11124-1"],"status":"published","title":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp...","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.58204,"percentile":0.99098,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2019-01-14T00:00:00Z","modified":"2026-10-24T10:30:17Z","exploits":[{"source":"exploitdb","id":"EDB-46516","title":"OpenSSH SCP Client - Write Arbitrary Files","type":"remote","platform":"multiple","date":"2019-01-11","url":"https://www.exploit-db.com/exploits/46516"},{"source":"exploitdb","id":"EDB-46193","title":"SCP Client - Multiple Vulnerabilities (SSHtranger Things)","type":"remote","platform":"multiple","date":"2019-01-18","url":"https://www.exploit-db.com/exploits/46193"},{"source":"pocgithub","id":"53n7hu/SNP","title":"53n7hu/SNP","date":"2020-05-12","url":"https://github.com/53n7hu/SNP"},{"source":"pocgithub","id":"mbadanoiu/MAL-008","title":"mbadanoiu/MAL-008","date":"2024-07-01","url":"https://github.com/mbadanoiu/MAL-008"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"dropbear","fixed_in":["2025.89-r0","2026.91-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"openssh","fixed_in":["7.5_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openssh","fixed_in":["7.5_p1-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openssh","fixed_in":["7.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openssh","fixed_in":["7.9_p1-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.9p1-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.9p1-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.9p1-9"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"openssh","fixed_in":["1:7.4p1-10+deb9u6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.fips.2.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.fips.2.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openssh","fixed_in":["1:7.6p1-4ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.89-r0"},{"fixed":"2026.91-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9_p1-r3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4p1-23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-2.23.0.3.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.9p1-9"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u8"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4","1:6.7p1-5+deb8u5","1:6.7p1-5+deb8u6","1:6.7p1-5+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.4p1-10+deb9u5"}]}],"versions":["1:7.4p1-10","1:7.4p1-10+deb9u1","1:7.4p1-10+deb9u2","1:7.4p1-10+deb9u3","1:7.4p1-10+deb9u4"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.4p1-10+deb9u6"}]}],"versions":["1:7.4p1-10","1:7.4p1-10+deb9u1","1:7.4p1-10+deb9u2","1:7.4p1-10+deb9u3","1:7.4p1-10+deb9u4","1:7.4p1-10+deb9u5"]},{"source":"osv","ecosystem":"Mageia:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5p1-2.4.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.3.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-30.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.35.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-9.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.42.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.13"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11","1:6.6p1-2ubuntu2.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.8"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6","1:7.2p2-4ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.8.1"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2.3","1:7.2p2-4ubuntu2.fips.2.4.1","1:7.2p2-4ubuntu2.fips.2.4.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.10.1"}]}],"versions":["1:7.2p2-4ubuntu2.fips.2.2","1:7.2p2-4ubuntu2.fips.2.2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.3"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.12"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.7"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.2"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.13"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11","1:6.6p1-2ubuntu2.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.8"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6","1:7.2p2-4ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.3"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-lp150.8.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6p1-lp150.8.15.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-7.4"}]}],"bundled":12}],"products":[{"vendor":"apache","product":"mina_sshd"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freebsd","product":"freebsd"},{"vendor":"fujitsu","product":"m10-1_firmware"},{"vendor":"fujitsu","product":"m10-4_firmware"},{"vendor":"fujitsu","product":"m10-4s_firmware"},{"vendor":"fujitsu","product":"m12-1_firmware"},{"vendor":"fujitsu","product":"m12-2_firmware"},{"vendor":"fujitsu","product":"m12-2s_firmware"},{"vendor":"openbsd","product":"openssh"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"siemens","product":"scalance_x204rna_eec_firmware"},{"vendor":"siemens","product":"scalance_x204rna_firmware"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"winscp","product":"winscp"}],"references":[{"url":"https://www.debian.org/security/2019/dsa-4387","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/106741","tags":["vdb-entry","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","tags":["x_transferred","Release Notes","advisory"]},{"url":"https://usn.ubuntu.com/3885-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3885-2/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677794","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","tags":["x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://www.exploit-db.com/exploits/46193/","tags":["exploit","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://security.gentoo.org/glsa/201903-16","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/18/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","tags":["vendor-advisory","x_transferred","Broken Link","web"]},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3702","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/08/02/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-412672.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23@%3Cdev.mina.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b@%3Cdev.mina.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a@%3Cdev.mina.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f@%3Cdev.mina.apache.org%3E"},{"url":"https://www.exploit-db.com/exploits/46193"},{"url":"https://usn.ubuntu.com/3885-2"},{"url":"https://usn.ubuntu.com/3885-1"},{"url":"https://security.netapp.com/advisory/ntap-20190213-0001"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G"},{"url":"https://github.com/advisories/GHSA-jr78-hfw4-xp7g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-6111","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-6111","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1754941200.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1774528369.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1774528630.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6111","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24308","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1707485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732449","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3702.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20685","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6109","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6111","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2019:3702","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121571","tags":["report"]},{"url":"https://bugzilla.suse.com/1121816","tags":["report"]},{"url":"https://bugzilla.suse.com/1121818","tags":["report"]},{"url":"https://bugzilla.suse.com/1121821","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6111","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190125-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190126-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190132-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125687","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190941-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1090671","tags":["report"]},{"url":"https://bugzilla.suse.com/1115550","tags":["report"]},{"url":"https://bugzilla.suse.com/1119183","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914016-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131709","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914030-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6111","tags":["report"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037459.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3885-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3885-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-20685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6109","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2MNLMLCJQ4RNIHX2VZUWA6ZK3G7XMXKU/#2MNLMLCJQ4RNIHX2VZUWA6ZK3G7XMXKU","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S63AIPCO4O55HWF7CTXNRODVU5X3HLUD/#S63AIPCO4O55HWF7CTXNRODVU5X3HLUD","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8858","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T00:00:00Z","modified":"2026-10-14T06:49:32.238Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-15678","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T00:00:00Z","modified":"2026-10-14T06:49:32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-jr78-hfw4-xp7g","title":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp...","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2022-05-13T01:22:35Z","modified":"2026-10-14T09:31:17Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T18:29:00.867Z","modified":"2026-10-14T07:16:56.12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T18:29:00.867Z","modified":"2026-09-21T06:17:52.54477527Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2019-6111","title":"CVE-2019-6111 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:57.927579Z","modified":"2026-01-26T09:48:00.903935Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T18:29:00.867Z","modified":"2026-10-24T10:30:17.13818667Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-31T18:29:00.867Z","modified":"2026-10-15T07:47:27.160004896Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2019:3702","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:36:25Z","modified":"2026-06-26T12:22:04.141441972Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RLSA-2019:3702","title":"Moderate: openssh security, bug fix, and enhancement update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nThe following packages have been upgraded to a later upstream version: openssh (8.0p1). (BZ#1691045)\n\nSecurity Fix(es):\n\n* openssh: scp client improper directory name validation (CVE-2018-20685)\n\n* openssh: Improper validation of object names allows malicious server to overwrite files via scp client (CVE-2019-6111)\n\n* openssh: Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.","status":"published","published":"2026-07-30T06:00:52.146294Z","modified":"2026-07-30T06:30:05.226813649Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","status":"published","published":"2019-01-14T00:00:00Z","modified":"2026-10-05T19:19:36.016828668Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"CLSA-2025-1754941200","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2025-08-11T19:40:04Z","modified":"2026-06-01T00:33:18.023627805Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1774528369","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2026-03-26T12:32:54Z","modified":"2026-06-01T00:33:27.102665332Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774528630","title":"openssh: Fix of 3 CVEs","description":"- CVE-2018-20685: fix a vulnerability scp client where a malicious server\n  could bypass intended access restrictions and modify target directory\n  permissions via crafted filenames\n- CVE-2019-6109: fix scp client where a malicious server could manipulate\n  the client's progress display output due to missing character encoding\n- CVE-2019-6111: fix scp client vulnerability that allowed a malicious\n  server to overwrite arbitrary files in the client's target directory,\n  including subdirectories, when performing transfers","status":"published","published":"2026-03-26T12:37:14Z","modified":"2026-06-01T00:33:28.163109261Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"DLA-1728-1","title":"openssh - security update","status":"published","published":"2019-03-25T00:00:00Z","modified":"2026-03-09T01:18:56.430992Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4387-1","title":"openssh - security update","status":"published","published":"2019-02-09T00:00:00Z","modified":"2026-03-09T02:09:14.227256Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4387-2","title":"openssh - security update","status":"published","published":"2019-03-02T00:00:00Z","modified":"2026-03-09T02:11:32.676487Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0156","title":"Updated openssh packages fix security vulnerabilities","description":"Updated openssh packages fix security vulnerabilities:\n\nDue to missing character encoding in the progress display, the object\nname can be used to manipulate the client output, for example to employ\nANSI codes to hide additional files being transferred (CVE-2019-6109).\n\nDue to scp client insufficient input validation in path names sent by\nserver, a malicious server can do arbitrary file overwrites in target\ndirectory. If the recursive (-r) option is provided, the server can\nalso manipulate subdirectories as well (CVE-2019-6111).\n\nThe check added in this version can lead to regression if the client and\nthe server have differences in wildcard expansion rules. If the server is\ntrusted for that purpose, the check can be disabled with a new -T option\nto the scp client.\n","status":"published","published":"2019-05-12T09:35:33Z","modified":"2026-04-16T04:40:56.223929907Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0091-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:50:30Z","modified":"2026-02-04T02:56:13.320746Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0307-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816)\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821)\n\nOther bug fixes and changes:\n\n- Handle brace expansion in scp when checking that filenames sent\n  by the server side match what the client requested (bsc#1125687)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:09:55Z","modified":"2026-02-04T03:06:10.344023Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11124-1","title":"openssh-8.4p1-7.4 on GA media","description":"These are all security issues fixed in the openssh-8.4p1-7.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:55.290754Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0125-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T13:19:17Z","modified":"2026-02-04T03:48:29.434241Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0125-2","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-04-29T06:02:04Z","modified":"2026-02-04T03:12:47.898735Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0126-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T13:19:59Z","modified":"2025-05-02T04:08:09.668344Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0132-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-21T08:35:19Z","modified":"2026-02-04T02:45:17.180098Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0496-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816)\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821)\n\nOther bug fixes and changes:\n\n- Handle brace expansion in scp when checking that filenames sent\n  by the server side match what the client requested (bsc#1125687)\n","status":"published","published":"2019-02-26T15:43:14Z","modified":"2026-02-04T03:50:07.534405Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0941-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\n","status":"published","published":"2019-04-12T13:58:12Z","modified":"2026-02-04T02:38:31.451313Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13931-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)\n- CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)\n- CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)\n- CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)\n","status":"published","published":"2019-01-18T15:30:38Z","modified":"2026-02-04T02:24:51.498539Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:14016-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\t  \n","status":"published","published":"2019-04-11T14:06:33Z","modified":"2026-02-04T04:05:22.868092Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:14030-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).\t  \n","status":"published","published":"2019-04-25T08:34:53Z","modified":"2026-02-04T03:02:11.075166Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1524-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6109: Fixed an character encoding issue in the progress display of\n  the scp client that could be used to manipulate client output, allowing\n  for spoofing during file transfers (bsc#1121816).\n- CVE-2019-6111: Properly validate object names received by the scp client to\n  prevent arbitrary file overwrites when interacting with a malicious SSH server\n  (bsc#1121821).\n\nOther issues fixed: \n\n- Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).\n- Returned proper reason for port forwarding failures (bsc#1090671).\n- Fixed a double free() in the KDF CAVS testing tool (bsc#1065237).\n","status":"published","published":"2019-06-17T15:30:39Z","modified":"2026-02-04T02:32:21.447393Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3885-1","title":"openssh vulnerabilities","description":"Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a\nuser or automated system were tricked into connecting to an untrusted\nserver, a remote attacker could possibly use these issues to write to\narbitrary files, change directory permissions, and spoof client output.\n","status":"published","published":"2019-02-07T18:50:47Z","modified":"2026-05-29T18:00:34.739013599Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-3885-2","title":"openssh vulnerability","description":"USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix\nfor CVE-2019-6111 turned out to be incomplete. This update fixes the\nproblem.\n\nOriginal advisory details:\n\n Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a\n user or automated system were tricked into connecting to an untrusted\n server, a remote attacker could possibly use these issues to write to\n arbitrary files, change directory permissions, and spoof client output.\n","status":"published","published":"2019-03-04T18:01:02Z","modified":"2026-02-10T04:41:28Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}