An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-openssh | Mar 7, 2019 | Jan 31, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-opensshamazon-linux-ami-2-upgrade-openssh-askpassamazon-linux-ami-2-upgrade-openssh-cavsamazon-linux-ami-2-upgrade-openssh-clientsamazon-linux-ami-2-upgrade-openssh-debuginfoamazon-linux-ami-2-upgrade-openssh-keycatamazon-linux-ami-2-upgrade-openssh-ldapamazon-linux-ami-2-upgrade-openssh-serveramazon-linux-ami-2-upgrade-openssh-server-sysvinitamazon-linux-ami-2-upgrade-pam_ssh_agent_auth | Apr 27, 2020 | Jan 31, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Oct 31, 2019 | Jan 18, 2019 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 31, 2019 | |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-askpass-debuginfocentos-upgrade-openssh-cavscentos-upgrade-openssh-cavs-debuginfocentos-upgrade-openssh-clientscentos-upgrade-openssh-clients-debuginfocentos-upgrade-openssh-debuginfocentos-upgrade-openssh-debugsourcecentos-upgrade-openssh-keycatcentos-upgrade-openssh-keycat-debuginfocentos-upgrade-openssh-ldapcentos-upgrade-openssh-ldap-debuginfocentos-upgrade-openssh-servercentos-upgrade-openssh-server-debuginfocentos-upgrade-pam_ssh_agent_authcentos-upgrade-pam_ssh_agent_auth-debuginfo | Nov 6, 2019 | Jan 31, 2019 |
| Debian | debian-upgrade-openssh | Feb 10, 2019 | Jan 18, 2019 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Jan 17, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-openssh | Mar 21, 2019 | Jan 31, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-opensshhuawei-euleros-2_0_sp2-upgrade-openssh-askpasshuawei-euleros-2_0_sp2-upgrade-openssh-clientshuawei-euleros-2_0_sp2-upgrade-openssh-keycathuawei-euleros-2_0_sp2-upgrade-openssh-server | Jun 17, 2020 | Jan 31, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-opensshhuawei-euleros-2_0_sp3-upgrade-openssh-askpasshuawei-euleros-2_0_sp3-upgrade-openssh-clientshuawei-euleros-2_0_sp3-upgrade-openssh-keycathuawei-euleros-2_0_sp3-upgrade-openssh-server | Apr 16, 2020 | Jan 31, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-opensshhuawei-euleros-2_0_sp5-upgrade-openssh-askpasshuawei-euleros-2_0_sp5-upgrade-openssh-clientshuawei-euleros-2_0_sp5-upgrade-openssh-keycathuawei-euleros-2_0_sp5-upgrade-openssh-server | May 7, 2019 | Jan 31, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-opensshhuawei-euleros-2_0_sp8-upgrade-openssh-askpasshuawei-euleros-2_0_sp8-upgrade-openssh-cavshuawei-euleros-2_0_sp8-upgrade-openssh-clientshuawei-euleros-2_0_sp8-upgrade-openssh-keycathuawei-euleros-2_0_sp8-upgrade-openssh-ldaphuawei-euleros-2_0_sp8-upgrade-openssh-server | Nov 19, 2019 | Jan 31, 2019 | |
| Ibm Aix | ibm-aix-openssh_advisory13 | Jul 17, 2019 | Jan 31, 2019 | |
| Openbsd Openssh | openbsd-openssh-upgrade-latest | Feb 4, 2019 | Jan 31, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-consolidation-osnet-osnet-incorporation-11-4-11-4-7-0-1-5-0oracle-solaris-11-4-upgrade-network-ssh-7-7-0-1-11-4-7-0-1-3-0 | Mar 20, 2019 | Jan 31, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-cavsoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-pam-ssh-agent-auth | Oct 5, 2022 | Nov 16, 2018 |
| Redhat Openshift | linuxrpm-upgrade-redhat-coreos | Dec 29, 2020 | Jan 31, 2019 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-askpass-debuginforedhat-upgrade-openssh-cavsredhat-upgrade-openssh-cavs-debuginforedhat-upgrade-openssh-clientsredhat-upgrade-openssh-clients-debuginforedhat-upgrade-openssh-debuginforedhat-upgrade-openssh-debugsourceredhat-upgrade-openssh-keycatredhat-upgrade-openssh-keycat-debuginforedhat-upgrade-openssh-ldapredhat-upgrade-openssh-ldap-debuginforedhat-upgrade-openssh-serverredhat-upgrade-openssh-server-debuginforedhat-upgrade-pam_ssh_agent_authredhat-upgrade-pam_ssh_agent_auth-debuginfo | Nov 6, 2019 | Jan 31, 2019 | |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-cavssuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-server | Jan 19, 2019 | Jan 18, 2019 |
| Ubuntu | ubuntu-upgrade-openssh-client | Feb 16, 2019 | Jan 18, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 31, 2019 | |
| Winscp | winscp-winscp-upgrade-latest | Sep 11, 2025 | Jan 31, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub