An issue was discovered in OpenSSH 7.9.
Priority MEDIUM 60CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.58204 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 49
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* | up to 7.9 | Vulnerable | OpenBSD |
| cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* | up to 5.1.3 | Vulnerable | Winscp |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions up to 7.9 Vulnerable ·OpenBSD
- cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* Versions up to 5.1.3 Vulnerable ·Winscp
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Show 39 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:a:apache:mina_sshd:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Apache |
| cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* | before 12.0 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:* | 12.0 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:* | 12.0 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:* | 12.0 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:* | 12.0 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:* | before xcp2361 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:* | before xcp3070 | Vulnerable | Fujitsu |
| cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:* | before 3.2.7 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:* | before 3.2.7 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x204rna_eec:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:a:apache:mina_sshd:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
- cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions before 12.0 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:* Versions 12.0 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:* Versions 12.0 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:* Versions 12.0 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:* Versions 12.0 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:* Versions before xcp2361 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:* Versions before xcp3070 Vulnerable ·Fujitsu
- cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:* Versions before 3.2.7 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:* Versions before 3.2.7 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x204rna_eec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
Red Hat 1 advisory
- RHSA-2019:3702 Released 2019-11-05 · Red Hat rating Moderateopenssh security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-3.el8
- Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-3.el8, openssh-cavs-8.0p1-3.el8, openssh-clients-8.0p1-3.el8 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:3702 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2019:3702 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6111
- 2026-10-03 Alias added: GHSA-jr78-hfw4-xp7g
References
Advisory 14
- DSA-4387
- https://security.netapp.com/advisory/ntap-20190213-0001/
- USN-3885-1
- USN-3885-2
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- GLSA-201903-16
- [debian-lts-announce] 20190325 [SECURITY] [DLA 1728-1] openssh security update
- [oss-security] 20190417 Announce: OpenSSH 8.0 released
- FEDORA-2019-0f4190cdb0
- openSUSE-SU-2019:1602
- FreeBSD-EN-19:10
- RHSA-2019:3702
- [oss-security] 20220802 CVE-2022-29154: Rsync client-side arbitrary file write vulnerability.
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
Other 5
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
- [mina-dev] 20190620 [jira] [Created] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so
- [mina-dev] 20190623 [jira] [Comment Edited] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so
- [mina-dev] 20190623 [jira] [Commented] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so
- [mina-dev] 20190820 [jira] [Resolved] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so
Sources
- CVE-2019-6111 · CVE Program
- CVE-2019-6111 · NVD
- FIRST EPSS
- GHSA-jr78-hfw4-xp7g · GitHub Advisory Database · CC BY 4.0
- CVE-2019-6111 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences