This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-6110 →

DEBIAN-CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipu...

Original description

The description as published by the source.

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org