Medium · published January 31, 2019
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
| Product | Versions | Fixed in |
|---|---|---|
| openbsd/openssh | ≤ 7.9 | — |
| winscp/winscp | ≤ 5.13 | — |
| netapp/element_software | all versions | — |
| netapp/ontap_select_deploy | all versions | — |
| netapp/storage_automation_store | all versions | — |
| siemens/scalance_x204rna_firmware | < 3.2.7 | 3.2.7 |
| siemens/scalance_x204rna_eec_firmware | < 3.2.7 | 3.2.7 |