UBUNTU-CVE-2019-6109

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2019-6109

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-6109.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-6109

Related

Published

2019-01-14T00:00:00Z

Modified

2019-01-14T00:00:00Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
6.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refreshprogressmeter() in progressmeter.c.

References

Affected packages

Ubuntu:14.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:6.6p1-2ubuntu2.12?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:6.6p1-2ubuntu2.12

Affected versions

1:6.*

1:6.2p2-6

1:6.2p2-6ubuntu1

1:6.4p1-1

1:6.4p1-2

1:6.5p1-1

1:6.5p1-2

1:6.5p1-3

1:6.5p1-4

1:6.5p1-6

1:6.6p1-1

1:6.6p1-2

1:6.6p1-2ubuntu1

1:6.6p1-2ubuntu2

1:6.6p1-2ubuntu2.2

1:6.6p1-2ubuntu2.3

1:6.6p1-2ubuntu2.4

1:6.6p1-2ubuntu2.6

1:6.6p1-2ubuntu2.7

1:6.6p1-2ubuntu2.8

1:6.6p1-2ubuntu2.10

1:6.6p1-2ubuntu2.11

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "ssh-askpass-gnome": "1:6.6p1-2ubuntu2.12",
            "ssh-askpass-gnome-dbgsym": "1:6.6p1-2ubuntu2.12",
            "openssh-client-udeb-dbgsym": "1:6.6p1-2ubuntu2.12",
            "openssh-client-udeb": "1:6.6p1-2ubuntu2.12",
            "ssh-krb5": "1:6.6p1-2ubuntu2.12",
            "openssh-server-udeb-dbgsym": "1:6.6p1-2ubuntu2.12",
            "openssh-sftp-server": "1:6.6p1-2ubuntu2.12",
            "openssh-sftp-server-dbgsym": "1:6.6p1-2ubuntu2.12",
            "openssh-client": "1:6.6p1-2ubuntu2.12",
            "openssh-server": "1:6.6p1-2ubuntu2.12",
            "openssh-server-udeb": "1:6.6p1-2ubuntu2.12",
            "openssh-server-dbgsym": "1:6.6p1-2ubuntu2.12",
            "ssh": "1:6.6p1-2ubuntu2.12",
            "openssh-client-dbgsym": "1:6.6p1-2ubuntu2.12"
        }
    ]
}

Ubuntu:16.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:7.2p2-4ubuntu2.7?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:7.2p2-4ubuntu2.7

Affected versions

1:6.*

1:6.9p1-2

1:6.9p1-3

1:7.*

1:7.1p1-1

1:7.1p1-3

1:7.1p1-4

1:7.1p1-6

1:7.1p2-1

1:7.1p2-2

1:7.2p1-1

1:7.2p2-1

1:7.2p2-2

1:7.2p2-3

1:7.2p2-4

1:7.2p2-4ubuntu1

1:7.2p2-4ubuntu2.1

1:7.2p2-4ubuntu2.2

1:7.2p2-4ubuntu2.4

1:7.2p2-4ubuntu2.5

1:7.2p2-4ubuntu2.6

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "openssh-client-ssh1-dbgsym": "1:7.2p2-4ubuntu2.7",
            "ssh-askpass-gnome-dbgsym": "1:7.2p2-4ubuntu2.7",
            "ssh-askpass-gnome": "1:7.2p2-4ubuntu2.7",
            "openssh-client-udeb-dbgsym": "1:7.2p2-4ubuntu2.7",
            "openssh-client-ssh1": "1:7.2p2-4ubuntu2.7",
            "openssh-client-udeb": "1:7.2p2-4ubuntu2.7",
            "ssh-krb5": "1:7.2p2-4ubuntu2.7",
            "openssh-server-udeb-dbgsym": "1:7.2p2-4ubuntu2.7",
            "openssh-client": "1:7.2p2-4ubuntu2.7",
            "openssh-sftp-server": "1:7.2p2-4ubuntu2.7",
            "openssh-sftp-server-dbgsym": "1:7.2p2-4ubuntu2.7",
            "openssh-server": "1:7.2p2-4ubuntu2.7",
            "openssh-server-udeb": "1:7.2p2-4ubuntu2.7",
            "openssh-server-dbgsym": "1:7.2p2-4ubuntu2.7",
            "ssh": "1:7.2p2-4ubuntu2.7",
            "openssh-client-dbgsym": "1:7.2p2-4ubuntu2.7"
        }
    ]
}

Ubuntu:18.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:7.6p1-4ubuntu0.2?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:7.6p1-4ubuntu0.2

Affected versions

1:7.*

1:7.5p1-10

1:7.6p1-4

1:7.6p1-4ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "openssh-client": "1:7.6p1-4ubuntu0.2",
            "ssh-askpass-gnome-dbgsym": "1:7.6p1-4ubuntu0.2",
            "openssh-sftp-server-dbgsym": "1:7.6p1-4ubuntu0.2",
            "ssh-askpass-gnome": "1:7.6p1-4ubuntu0.2",
            "openssh-sftp-server": "1:7.6p1-4ubuntu0.2",
            "openssh-server-udeb": "1:7.6p1-4ubuntu0.2",
            "openssh-server": "1:7.6p1-4ubuntu0.2",
            "openssh-server-dbgsym": "1:7.6p1-4ubuntu0.2",
            "openssh-client-udeb": "1:7.6p1-4ubuntu0.2",
            "ssh": "1:7.6p1-4ubuntu0.2",
            "openssh-client-dbgsym": "1:7.6p1-4ubuntu0.2"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-8

1:7.5p1-9

1:7.5p1-9build1

1:7.5p1-10

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-11build1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-12

1:7.5p1-12build1

1:7.5p1-13

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-14

1:7.5p1-15

1:7.5p1-15build1

1:7.5p1-16

Ecosystem specific

{
    "ubuntu_priority": "medium"
}