CVE-2019-6109: canonical ubuntu_linux Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2019-6109 is a medium (CVSS 6.8) Improper Encoding or Escaping of Output vulnerability in canonical ubuntu_linux. EPSS estimates a 3.81% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 18 · Related 14Timeline
- 31-01-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
3.81%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.81% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fujitsu6 products
- m10-1_firmware< xcp2361 | < xcp3070
- m10-4_firmware< xcp2361 | < xcp3070
- m10-4s_firmware< xcp2361 | < xcp3070
- m12-1_firmware< xcp2361 | < xcp3070
- m12-2_firmware< xcp2361 | < xcp3070
Redhat4 products
- enterprise_linux8.0
- enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
- enterprise_linux_server_aus8.2 | 8.4 | 8.6
- enterprise_linux_server_tus8.2 | 8.4 | 8.6
Netapp3 products
Debian2 products
- openssh< 1:7.9p1-6
- debian_linuxEOL8.0 | 9.0
Siemens2 products
- scalance_x204rna_firmware< 3.2.7
- scalance_x204rna_eec_firmware< 3.2.7
Ubuntu2 products
- openssh< 1:6.6p1-2ubuntu2.12 | < 1:7.2p2-4ubuntu2.7 | < 1:7.2p2-4ubuntu2.fips.2.8.1 | < 1:7.2p2-4ubuntu2.fips.2.10.1 | < 1:7.6p1-4ubuntu0.2
- openssh-ssh1All versions (No fix recorded)
Alpine1 product
- openssh< 7.9_p1-r3 | < 7.5_p1-r4 | < 7.5_p1-r10 | < 7.7_p1-r4
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Fedoraproject1 product
- fedoraEOL30
Openbsd1 product
- openssh≤ 7.9
Winscp1 product
- winscp≤ 5.13
11 vendors · 24 products
References
21 links
- security.netapp.com/advisory/ntap-20190213-0001/Third Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory