CVE-2021-36370
- Source
- https://cve.org/CVERecord?id=CVE-2021-36370
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36370.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-36370
- Downstream
- Related
- Published
- 2021-08-30T19:15:08.917Z
- Modified
- 2026-02-05T00:02:52.657684Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
- References
-
- https://sourceforge.net/projects/mcwin32/files/
- https://docs.ssh-mitm.at/CVE-2021-36370.html
- https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484
- https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
- https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html
- https://midnight-commander.org/
- https://sourceforge.net/projects/mcwin32/files/
- https://docs.ssh-mitm.at/CVE-2021-36370.html
- https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484
- https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c
Affected packages
Git / github.com/midnightcommander/mc
Affected ranges
- Type
- GIT
- Repo
- https://github.com/midnightcommander/mc
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
4.*
4.6.1
4.6.2
4.6.2-pre1
4.6.99
4.6.99.1
4.6.99.2
4.6.99.3
4.7.0
4.7.0-pre1
4.7.0-pre2
4.7.0-pre3
4.7.0-pre4
4.7.0.1
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.5-pre1
4.8.0
4.8.0-pre1
4.8.0-pre2
4.8.1
4.8.10
4.8.11
4.8.12
4.8.13
4.8.14
4.8.15
4.8.16
4.8.17
4.8.18
4.8.19
4.8.2
4.8.20
4.8.21
4.8.22
4.8.23
4.8.24
4.8.25
4.8.26
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9