CVE-2019-6110

Name of the Vulnerable Software and Affected Versions OpenSSH version 7.9

Description The issue allows a malicious server or Man-in-The-Middle attacker to manipulate the client output, for example, by using ANSI control codes to hide additional files being transferred. This is due to the acceptance and display of arbitrary stderr output from the server. The vulnerability is related to insufficient access control in the implementation of the scp utility for remote file copying, which can allow a remote attacker to hide the name of the file being transferred.

Recommendations For OpenSSH version 7.9, consider restricting access to the scp client until a patch is available, and be cautious of files transferred from untrusted sources to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of the scp client for remote file copying until a patch is available.