PRIOn knowledge basePRION:CVE-2021-36370

HistoryAug 30, 2021 - 7:15 p.m.

Code injection

2021-08-3019:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.2%

JSON

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

CPENameOperatorVersion
midnight_commanderle4.8.26

CPE	Name	Operator	Version
	midnight_commander	le	4.8.26

References

docs.ssh-mitm.at/CVE-2021-36370.html

github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c

github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c

mail.gnome.org/archives/mc-devel/2021-August/msg00008.html

midnight-commander.org/

sourceforge.net/projects/mcwin32/files/