CVE-2021-36370

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

References

Affected packages

Git / github.com/midnightcommander/mc

Affected ranges

Type

GIT

Repo

https://github.com/midnightcommander/mc

Events

Introduced

Last affected

a88a626e76139259e5b6fc0db39045f051e243dd

Database specific

Show details

{
    "cpe": "cpe:2.3:a:midnight-commander:midnight_commander:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.8.26"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

4.*

4.6.1

4.6.2-pre1

4.6.99

4.6.99.1

4.6.99.2

4.6.99.3

4.7.0

4.7.0-pre1

4.7.0-pre2

4.7.0-pre3

4.7.0-pre4

4.7.0.1

4.7.1

4.7.2

4.7.3

4.7.4

4.7.5

4.7.5-pre1

4.8.0

4.8.0-pre1

4.8.0-pre2

4.8.1

4.8.10

4.8.11

4.8.12

4.8.13

4.8.14

4.8.15

4.8.16

4.8.17

4.8.18

4.8.19

4.8.2

4.8.20

4.8.21

4.8.22

4.8.23

4.8.24

4.8.25

4.8.26

4.8.3

4.8.4

4.8.5

4.8.6

4.8.7

4.8.8

4.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36370.json"