CVE-2019-6111
MediumExploitedPublic exploitDue to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client.
Published Jan 31, 2019 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2019-6111, DEBIAN-CVE-2019-6111, DSA-4387-2, UBUNTU-CVE-2019-6111, USN-3885-2
Key Facts
Patch immediately- CVE-2019-6111 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Mina Sshd (Apache), Openssh (Openbsd), Winscp and 22 more products.
- It is exploited in the wild, listed in Industry KEV feed since Nov 2, 2020 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 58% probability of exploitation in the next 30 days.
- Fixed versions are available, including dropbear 2025.89-r0, dropbear 2026.91-r0, Freebsd 12.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (30-day exploit likelihood)
58%
Higher than 99.0% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-6111 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Nov 2, 2020 | n/a | Known |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
244 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Mina SshdApache | 2.2.0 | n/a |
| OpensshOpenbsd | See advisory | 7.9 |
| WinscpWinscp | See advisory | 5.1.3 |
| Ubuntu LinuxCanonical | 14.04, 16.04, 18.04, 18.10 | n/a |
| Debian LinuxDebian | 8.0, 9.0 | n/a |
Patched Releases
dropbear
2025.89-r0, 2026.91-r0
Freebsd
12.0
M10-1 Firmware
xcp2361, xcp3070
M10-4 Firmware
xcp2361, xcp3070
M10-4s Firmware
xcp2361, xcp3070
M12-1 Firmware
xcp2361, xcp3070
M12-2 Firmware
xcp2361, xcp3070
M12-2s Firmware
xcp2361, xcp3070
Openssh
<=7.9, 0:8.0p1-3.el8, 1:6.6p1-2ubuntu2.12, 1:6.6p1-2ubuntu2.13, 1:6.7p1-5+deb8u8, 1:7.2p2-4ubuntu2.7, 1:7.2p2-4ubuntu2.8, 1:7.2p2-4ubuntu2.fips.2.10.1, 1:7.2p2-4ubuntu2.fips.2.8.1, 1:7.4p1-10+deb9u5, 1:7.4p1-10+deb9u6, 1:7.6p1-4ubuntu0.2, 1:7.6p1-4ubuntu0.3, 1:7.9p1-9, 6.6p1-36.12.1, 6.6p1-36.20.1, 6.6p1-41.18.1, 6.6p1-54.26.1, 6.6p1-54.32.1, 7.2p2-29.1, 7.2p2-35.1, 7.2p2-74.35.1, 7.2p2-74.42.8, 7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 7.4p1-9.ph1, 7.5_p1-r10, 7.5_p1-r4, 7.5p1-13.ph2, 7.6p1-9.13.1, 7.6p1-9.23.1, 7.6p1-lp150.8.15.2, 7.6p1-lp150.8.9.1, 7.7_p1-r4, 7.8p1-3.ph3, 7.9_p1-r3, 8.0p1-1, 8.0p1-3.el8, 8.0p1-30.el8_10, 8.4p1-7.4
openssh-askpass
7.4p1-16.amzn2.0.6, 8.0p1-3.el8
openssh-askpass-gnome
6.6p1-36.12.1, 6.6p1-36.20.1, 6.6p1-41.18.1, 6.6p1-54.26.1, 6.6p1-54.32.1, 7.2p2-29.1, 7.2p2-35.1, 7.2p2-74.35.1, 7.2p2-74.42.10, 7.6p1-9.13.1, 7.6p1-9.23.1, 7.6p1-lp150.8.15.1, 7.6p1-lp150.8.9.1
openssh-cavs
7.2p2-29.1, 7.2p2-35.1, 7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 7.6p1-lp150.8.15.2, 7.6p1-lp150.8.9.1, 8.0p1-3.el8, 8.4p1-7.4
openssh-clients
7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 8.0p1-3.el8, 8.4p1-7.4
openssh-common
8.4p1-7.4
openssh-fips
6.6p1-36.12.1, 6.6p1-36.20.1, 6.6p1-54.26.1, 6.6p1-54.32.1, 7.2p2-29.1, 7.2p2-35.1, 7.2p2-74.35.1, 7.2p2-74.42.8, 7.6p1-9.13.1, 7.6p1-9.23.1, 7.6p1-lp150.8.15.2, 7.6p1-lp150.8.9.1, 8.4p1-7.4
openssh-helpers
6.6p1-36.12.1, 6.6p1-36.20.1, 6.6p1-54.26.1, 6.6p1-54.32.1, 7.2p2-29.1, 7.2p2-35.1, 7.2p2-74.35.1, 7.2p2-74.42.8, 7.6p1-9.13.1, 7.6p1-9.23.1, 7.6p1-lp150.8.15.2, 7.6p1-lp150.8.9.1, 8.4p1-7.4
openssh-keycat
7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 8.0p1-3.el8
openssh-ldap
7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 8.0p1-3.el8
openssh-server
7.4p1-16.amzn2.0.6, 7.4p1-21.73.amzn1, 8.0p1-3.el8, 8.4p1-7.4
openssh-server-sysvinit
7.4p1-16.amzn2.0.6
pam_ssh_agent_auth
0.10.3-2.16.amzn2.0.6, 0.10.3-2.21.73.amzn1, 0.10.3-7.3.el8
rootio-openssh
1:7.9p1-9, 7.9_p1-r3
Scalance X204rna Eec Firmware
3.2.7
Scalance X204rna Firmware
3.2.7
Winscp
<=5.1.3
Timeline
Publicly disclosed
Jan 31, 2019
Added to Industry KEV feed
Nov 2, 2020
Last updated
Oct 16, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryRHSA-2019:3702
- advisoryhttps://bugzilla.suse.com/1065237
- advisoryhttps://bugzilla.suse.com/1090671
- advisoryhttps://bugzilla.suse.com/1115550
- advisoryhttps://bugzilla.suse.com/1119183
FAQ
Common Questions.
An issue was discovered in OpenSSH 7.9.
Affected: Mina Sshd (Apache) versions 2.2.0; Openssh (Openbsd); Winscp, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Nov 2, 2020 and is known to be used in ransomware campaigns.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including dropbear 2025.89-r0, dropbear 2026.91-r0, Freebsd 12.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-6111 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo