High severity7.5NVD Advisory· Published Aug 30, 2021· Updated Jun 17, 2026
CVE-2021-36370
CVE-2021-36370
Description
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:a:midnight-commander:midnight_commander:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:midnight-commander:midnight_commander:*:*:*:*:*:*:*:*range: <=4.8.26
- (no CPE)range: <=4.8.26
- Midnight Commander/Midnight Commanderdescription
- Range: <=4.8.26
- osv-coords3 versionspkg:rpm/opensuse/mc&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/mc&distro=openSUSE%20Tumbleweedpkg:rpm/suse/mc&distro=SUSE%20Package%20Hub%2015%20SP3
< 4.8.27-bp153.2.3.1+ 2 more
- (no CPE)range: < 4.8.27-bp153.2.3.1
- (no CPE)range: < 4.8.27-1.1
- (no CPE)range: < 4.8.27-bp153.2.3.1
Patches
Vulnerability mechanics
References
6- docs.ssh-mitm.at/CVE-2021-36370.htmlnvdExploitThird Party Advisory
- github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.cnvdExploitThird Party Advisory
- github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.cnvdExploitThird Party Advisory
- mail.gnome.org/archives/mc-devel/2021-August/msg00008.htmlnvdRelease NotesThird Party Advisory
- midnight-commander.orgnvdVendor Advisory
- sourceforge.net/projects/mcwin32/files/nvdProductThird Party Advisory
News mentions
0No linked articles in our index yet.