Bug 1121821 (CVE-2019-6111) - VUL-0: CVE-2019-6111: openssh,openssh-openssl1: scp client missing received object name validation
Summary: VUL-0: CVE-2019-6111: openssh,openssh-openssl1: scp client missing received o...
Status: RESOLVED FIXED
Alias: CVE-2019-6111
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Deadline: 2019-04-08
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/222746/
Whiteboard: CVSSv2:NVD:CVE-2019-6111:5.8:(AV:N/AC...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-14 10:43 UTC by Karol Babioch
Modified: 2023-05-30 10:41 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Karol Babioch 2019-01-14 10:43:34 UTC 
CVE-2019-6111

2. CWE-20: scp client missing received object name validation [CVE-2019-6111]

Due to the scp implementation being derived from 1983 rcp [1], the server chooses which
files/directories are sent to the client. However, scp client only perform cursory
validation of the object name returned (only directory traversal attacks are prevented).
A malicious scp server can overwrite arbitrary files in the scp client target directory.
If recursive operation (-r) is performed, the server can manipulate subdirectories
as well (for example overwrite .ssh/authorized_keys).

The same vulnerability in WinSCP is known as CVE-2018-20684.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6111
http://seclists.org/oss-sec/2019/q1/63
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://sintonen.fi/advisories/scp-name-validator.patch
Comment 1 Pedro Monreal Gonzalez 2019-01-15 13:23:53 UTC 
I would wait for upstream to review the patch for CVE-2019-6109, CVE-2019-6110 and CVE-2019-6109.
Comment 6 Swamp Workflow Management 2019-01-18 17:12:36 UTC 
SUSE-SU-2019:0125-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    openssh-6.6p1-54.26.1, openssh-askpass-gnome-6.6p1-54.26.1
SUSE Linux Enterprise Server 12-LTSS (src):    openssh-6.6p1-54.26.1, openssh-askpass-gnome-6.6p1-54.26.1
Comment 7 Swamp Workflow Management 2019-01-18 17:15:44 UTC 
SUSE-SU-2019:0126-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    openssh-7.6p1-9.13.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    openssh-7.6p1-9.13.1
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    openssh-askpass-gnome-7.6p1-9.13.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    openssh-7.6p1-9.13.1
Comment 8 Swamp Workflow Management 2019-01-18 20:10:23 UTC 
SUSE-SU-2019:13931-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    openssh-6.6p1-36.12.1, openssh-askpass-gnome-6.6p1-36.12.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    openssh-6.6p1-36.12.1, openssh-askpass-gnome-6.6p1-36.12.1
Comment 9 Swamp Workflow Management 2019-01-21 14:13:14 UTC 
SUSE-SU-2019:0132-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
SUSE OpenStack Cloud 7 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Server 12-SP4 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Server 12-SP3 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE Enterprise Storage 4 (src):    openssh-7.2p2-74.35.1, openssh-askpass-gnome-7.2p2-74.35.1
SUSE CaaS Platform ALL (src):    openssh-7.2p2-74.35.1
SUSE CaaS Platform 3.0 (src):    openssh-7.2p2-74.35.1
OpenStack Cloud Magnum Orchestration 7 (src):    openssh-7.2p2-74.35.1
Comment 12 Swamp Workflow Management 2019-01-28 14:09:42 UTC 
openSUSE-SU-2019:0091-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
openSUSE Leap 15.0 (src):    openssh-7.6p1-lp150.8.9.1, openssh-askpass-gnome-7.6p1-lp150.8.9.1
Comment 13 Swamp Workflow Management 2019-01-29 14:14:04 UTC 
openSUSE-SU-2019:0093-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
openSUSE Leap 42.3 (src):    openssh-7.2p2-29.1, openssh-askpass-gnome-7.2p2-29.1
Comment 20 Swamp Workflow Management 2019-02-19 09:00:13 UTC 
This is an autogenerated message for OBS integration:
This bug (1121821) was mentioned in
https://build.opensuse.org/request/show/677282 Factory / openssh
Comment 23 Swamp Workflow Management 2019-02-26 20:13:58 UTC 
SUSE-SU-2019:0496-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1121816,1121821,1125687
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    openssh-7.6p1-9.23.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    openssh-7.6p1-9.23.1
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    openssh-askpass-gnome-7.6p1-9.23.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    openssh-7.6p1-9.23.1
Comment 24 Swamp Workflow Management 2019-03-08 14:12:07 UTC 
openSUSE-SU-2019:0307-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1121816,1121821,1125687
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
openSUSE Leap 15.0 (src):    openssh-7.6p1-lp150.8.15.2, openssh-askpass-gnome-7.6p1-lp150.8.15.1
Comment 28 Swamp Workflow Management 2019-04-01 16:25:20 UTC 
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2019-04-08.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64248
Comment 30 Swamp Workflow Management 2019-04-11 19:10:19 UTC 
SUSE-SU-2019:14016-1: An update that solves two vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1090671,1115550,1119183,1121816,1121821,1131709
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    openssh-6.6p1-41.18.1, openssh-askpass-gnome-6.6p1-41.18.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    openssh-6.6p1-41.18.1, openssh-askpass-gnome-6.6p1-41.18.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 31 Swamp Workflow Management 2019-04-12 19:11:14 UTC 
SUSE-SU-2019:0941-1: An update that solves two vulnerabilities and has three fixes is now available.

Category: security (moderate)
Bug References: 1090671,1115550,1119183,1121816,1121821
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    openssh-6.6p1-54.32.1, openssh-askpass-gnome-6.6p1-54.32.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    openssh-6.6p1-54.32.1, openssh-askpass-gnome-6.6p1-54.32.1
SUSE Linux Enterprise Server 12-LTSS (src):    openssh-6.6p1-54.32.1, openssh-askpass-gnome-6.6p1-54.32.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 32 Swamp Workflow Management 2019-04-25 13:11:53 UTC 
SUSE-SU-2019:14030-1: An update that solves two vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1090671,1115550,1119183,1121816,1121821,1131709
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    openssh-6.6p1-36.20.1, openssh-askpass-gnome-6.6p1-36.20.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    openssh-6.6p1-36.20.1, openssh-askpass-gnome-6.6p1-36.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 33 Swamp Workflow Management 2019-04-29 10:19:58 UTC 
SUSE-SU-2019:0125-2: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1121571,1121816,1121818,1121821
CVE References: CVE-2018-20685,CVE-2019-6109,CVE-2019-6110,CVE-2019-6111
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    openssh-6.6p1-54.26.1, openssh-askpass-gnome-6.6p1-54.26.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 34 Swamp Workflow Management 2019-06-17 19:12:11 UTC 
SUSE-SU-2019:1524-1: An update that solves two vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1065237,1090671,1119183,1121816,1121821,1131709
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
SUSE OpenStack Cloud 7 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Server 12-SP4 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Server 12-SP3 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Server 12-SP2-BCL (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Desktop 12-SP4 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Linux Enterprise Desktop 12-SP3 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE Enterprise Storage 4 (src):    openssh-7.2p2-74.42.8, openssh-askpass-gnome-7.2p2-74.42.10
SUSE CaaS Platform ALL (src):    openssh-7.2p2-74.42.8
SUSE CaaS Platform 3.0 (src):    openssh-7.2p2-74.42.8
OpenStack Cloud Magnum Orchestration 7 (src):    openssh-7.2p2-74.42.8

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 35 Swamp Workflow Management 2019-06-24 13:31:37 UTC 
openSUSE-SU-2019:1602-1: An update that solves two vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1065237,1090671,1119183,1121816,1121821,1131709
CVE References: CVE-2019-6109,CVE-2019-6111
Sources used:
openSUSE Leap 42.3 (src):    openssh-7.2p2-35.1, openssh-askpass-gnome-7.2p2-35.1
Comment 36 Alexandros Toptsoglou 2020-04-24 15:56:44 UTC 
Done