CVE-2019-6111

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being
derived from 1983 rcp, the server chooses which files/directories are sent
to the client. However, the scp client only performs cursory validation of
the object name returned (only directory traversal attacks are prevented).
A malicious scp server (or Man-in-The-Middle attacker) can overwrite
arbitrary files in the scp client target directory. If recursive operation
(-r) is performed, the server can manipulate subdirectories as well (for
example, to overwrite the .ssh/authorized_keys file).

Notes