CVE-2021-36370

Name of the Vulnerable Software and Affected Versions Midnight Commander versions through 4.8.26

Description The issue is related to the lack of server fingerprint checking and display in Midnight Commander. This allows a remote attacker to potentially compromise data integrity by connecting to a server without verifying its authenticity. When establishing an SFTP connection, the server's fingerprint is neither checked nor displayed, resulting in the user being unable to verify the server's authenticity.

Recommendations For Midnight Commander versions through 4.8.26, consider disabling SFTP connections until a patch is available to address the lack of server fingerprint verification. As a temporary workaround, users should manually verify the server's authenticity before establishing a connection.