{"id":"CVE-2021-36370","aliases":["AZL-6678","DEBIAN-CVE-2021-36370","EUVD-2021-22990","GHSA-j8px-qjm3-fx72","MGASA-2022-0086","OESA-2022-1771","UBUNTU-CVE-2021-36370","USN-5160-1","openSUSE-SU-2022:0061-1","openSUSE-SU-2024:11580-1"],"status":"published","title":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP...","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0199,"percentile":0.80918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2021-08-30T18:37:23Z","modified":"2026-10-23T18:00:19Z","fixes":[{"ecosystem":"Azure Linux:2","package":"mc","fixed_in":["4.8.27-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mc","fixed_in":["3:4.8.27-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mc","fixed_in":["3:4.8.27-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mc","fixed_in":["3:4.8.27-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"mc","fixed_in":["4.8.27-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"mc","fixed_in":["4.8.28-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"mc","fixed_in":["4.8.28-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"mc","fixed_in":["4.8.28-1.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mc","fixed_in":["3:4.8.11-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mc","fixed_in":["3:4.8.15-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mc","fixed_in":["3:4.8.19-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mc","fixed_in":["3:4.8.24-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"mc","fixed_in":["3:4.8.27-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"mc","fixed_in":["4.8.27-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"mc","fixed_in":["4.8.27-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mc","fixed_in":["4.8.27-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.27-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.27-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.27-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.27-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.27-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.28-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.28-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.28-1.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.11-1ubuntu0.1~esm1"}]}],"versions":["3:4.8.5-1","3:4.8.10-4","3:4.8.11-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.15-2ubuntu0.1~esm1"}]}],"versions":["3:4.8.13-3","3:4.8.15-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.19-1ubuntu0.1~esm1"}]}],"versions":["3:4.8.19-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.24-2ubuntu1+esm1"}]}],"versions":["3:4.8.22-1build1","3:4.8.23-1","3:4.8.24-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.27-1"}]}],"versions":["3:4.8.26-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.11-1ubuntu0.1~esm1"}]}],"versions":["3:4.8.5-1","3:4.8.10-4","3:4.8.11-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.15-2ubuntu0.1~esm1"}]}],"versions":["3:4.8.13-3","3:4.8.15-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.19-1ubuntu0.1~esm1"}]}],"versions":["3:4.8.19-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.8.24-2ubuntu1+esm1"}]}],"versions":["3:4.8.22-1build1","3:4.8.23-1","3:4.8.24-2ubuntu1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.27-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.27-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.27-1.1"}]}]}],"products":[{"vendor":"midnight-commander","product":"midnight_commander"}],"references":[{"url":"https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://sourceforge.net/projects/mcwin32/files/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","report"]},{"url":"https://midnight-commander.org/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://docs.ssh-mitm.at/CVE-2021-36370.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36370","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j8px-qjm3-fx72"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-36370","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0086.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30107","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5SJPZ2MSI7IPFCS5TFZZVXF4NN6XKYKJ/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1771","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-36370","tags":["report"]},{"url":"https://github.com/MidnightCommander/mc/commit/9235d3c232d13ad7f973346077c9cf2eaa77dc5f","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5160-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36370","tags":["report"]},{"url":"https://bugzilla.suse.com/1190180","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36370","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-36370","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T18:37:23Z","modified":"2024-08-04T00:54:51.423Z","updated_at":"2026-11-02T14:33:05.989686Z"}],"euvd":[{"id":"EUVD-2021-22990","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T18:37:23Z","modified":"2024-08-04T00:54:51Z","updated_at":"2026-11-03T03:24:29.877227Z"}],"ghsa":[{"id":"GHSA-j8px-qjm3-fx72","title":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP...","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2022-05-24T19:12:26Z","modified":"2023-01-30T05:01:49Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:46:29.807452Z"}],"nvd":[{"id":"CVE-2021-36370","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T19:15:08.917Z","modified":"2026-06-17T03:58:45.687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"AZL-6678","title":"CVE-2021-36370 affecting package mc for versions less than 4.8.27-1","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T19:15:08Z","modified":"2026-04-21T04:37:58.649414Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CVE-2021-36370","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T19:15:08.917Z","modified":"2026-10-20T10:54:49.402172951Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-36370","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T19:15:08.917Z","modified":"2026-10-23T18:00:19.955943754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1771","title":"mc security update","description":"GNU Midnight Commander is a visual file manager, licensed under GNU General Public License and therefore qualifies as Free Software. It\u0026apos;s a feature rich full-screen text mode application that allows you to copy, move and delete files and whole directory trees, search for files and run commands in the subshell. Internal viewer and editor are included.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.(CVE-2021-36370)","status":"published","published":"2022-07-22T11:05:02Z","modified":"2026-08-18T01:16:50.821535606Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-36370","description":"An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.","status":"published","published":"2021-08-30T19:15:00Z","modified":"2026-02-04T03:11:24.953368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"MGASA-2022-0086","title":"Updated mc packages fix security vulnerability","description":"An issue was discovered in Midnight Commander through 4.8.26. When\nestablishing an SFTP connection, the fingerprint of the server is neither\nchecked nor displayed. As a result, a user connects to the server without\nthe ability to verify its authenticity. (CVE-2021-36370)\n","status":"published","published":"2022-03-06T10:40:17Z","modified":"2026-04-16T04:42:03.962927889Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0061-1","title":"Security update for mc","description":"This update for mc fixes the following issues:\n\nMidnight Commander 4.8.27:\n\n* Core\n\n  - Reimplement version detection (#3603, #4249)\n  - Significantly reduce rebuilt time after version change (#2252, #4266)\n  - Drop automatic migration of configuration from ~/.mc to XDG-based directories (#3682)\n  - zsh: support custom configuration file: ~/.local/share/mc/.zshrc (#4203)\n  - Widgets: implement WST_VISIBLE state to show/hide widgets (#2919)\n  - Find File: add Follow symlinks option (#2020) \n\n* VFS\n\n  - extfs: support unrar-6 (#4154)\n  - extfs: support official 7z binary (7zz) (#4239)\n  - ftpfs: apply file list parser from lftp project (#2841, #3174) \n\n* Editor\n\n  - Word completion: get candidates from all open files (#4160)\n  - etags: get rid of hardcoded list length and window width (#4132)\n  - Update syntax files:\n    - python (#4140) \n  - Add syntax highlighting:\n    - Verilog and SystemVerilog? header files (#4215)\n    - JSON (#4250)\n    - openrc-run scripts (#4246) \n* Misc\n\n  - Filehighlight of c++ and h++ files as sources (#4194)\n  - Filehighlight of JSON files as documents (#4250)\n  - Support of alacritty terminal emulator (​https://github.com/alacritty/alacritty) (#4248)\n  - Support of foot terminal emulator (​https://codeberg.org/dnkl/foot) (#4251)\n  - Support of (alt+)shift+arrow keys in st terminal emulator (st.suckless.org) (#4267)\n  - Mouse support in screen: don't check  variable (#4233)\n  - mc.ext: support fb2 e-books (#4167)\n  - ext.d: use mediainfo to view info about various media files (#4167)\n  - Remove OS/distro-specific package-related stuff from source tree (#4217) \n\n* Fixes\n\n  - FTBFS against NCurses on OS X 10.9.5 (#4181)\n  - Segfault on dialog before panels get visible (#4244)\n  - Crash if shadow is out of screen (build against NCurses) (#4192)\n  - Crash in search (#4222)\n  - Crash on startup with enabled subshell in FreeBSD (workaround) (#4213)\n  - Hang on start randomly with zsh as subshell (#4198)\n  - If command line is invisible it's partially displayed (#4182)\n  - Broken handling of zip archives (#4180, #4183)\n  - Broken handling of jar files as zip archives (#4223)\n  - Timestamps of symlinks, sockets, fifos, etc are not preserved after copy/move (#3985)\n  - %view action in the user menu doesn't work on no-exec filesystem (#4242)\n  - Hardlinks are not colored by file type or extension (#3375)\n  - mcedit: silent macro makes terminal disrupted (#4171)\n  - mcedit: disrupting of TAGS file path (#4207)\n  - vfs: unable to browse compressed tar archives (#4191)\n  - sftpfs vfs: CVE-2021-36370: server fingerprint isn't verified \n    (discovered by AUT-milCERT during an audit of open source software) (#4259)\n  - ftpfs vfs: month of file is always January (#4260)\n  - Tests: log files are written by libcheck and automake simultaneously (#3986) \n","status":"published","published":"2022-03-01T17:02:24Z","modified":"2026-02-04T02:24:34.292835Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11580-1","title":"mc-4.8.27-1.1 on GA media","description":"These are all security issues fixed in the mc-4.8.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:03.279293Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5160-1","title":"mc vulnerability","description":"It was discovered that Midnight Commander would not check server fingerprints\nwhen establishing an SFTP connection. If a remote attacker were able to intercept\ncommunications this flaw could be exploited to impersonate the SFTP server.\n","status":"published","published":"2022-08-09T11:44:21Z","modified":"2026-06-29T13:49:34.804394418Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}