In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

This CVE is disputed by the upstream OpenSSH project. Amazon Linux does not consider this issue to be a vulnerability. Users are recommended to switch to sftp if possible, and when using scp only connect to trusted systems.