CVE-2019-6111mediumobserved exploitationCWE-22

CVE-2019-6111

Published · Updated

Follow this CVE+ Monitor openssh+ Monitor openssh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

67Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 5.9epss 58%
from disclosure to weaponsame day
Published on NVDJan 31
1st PoCJan 11
VulnCheck+641d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
3 products (18 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
workaround: This issue only affects the users of scp binary which is a part of openssh-clients package. Other usage of SSH protocol or other ssh clients is not affected…
Fixed
2 products (138 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8)
fix ↗
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.