CVE-2021-36370
Fixed in a distro release EPSS 2%
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
Products: midnight_commander
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | mc | 1:4.8.29-1.amzn2 |
| Arch Linux | mc | 4.8.27-1 |
| Debian 12 | mc | 3:4.8.27-1 |
| Debian 13 | mc | 3:4.8.27-1 |
| Debian 14 | mc | 3:4.8.27-1 |
| SUSE Package Hub 15 SP3 | mc | 4.8.27-bp153.2.3.1 |
| Ubuntu 22.04 LTS | mc | 3:4.8.27-1 |
| Ubuntu Pro 14.04 LTS | mc | 3:4.8.11-1ubuntu0.1~esm1 |
| Ubuntu Pro 16.04 LTS | mc | 3:4.8.15-2ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | mc | 3:4.8.19-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | mc | 3:4.8.24-2ubuntu1+esm1 |
| openSUSE Leap 15.3 | mc | 4.8.27-bp153.2.3.1 |
| openSUSE Tumbleweed | mc | 4.8.27-1.1 |