Vulnerability · Published Sep 27, 2023 · Assigned by GitHub_M
CVE-2023-42818SSH public key login without private key challenge if mfa is enabled in jumpserver
Medium 5.4
In plain English
A medium-severity improper authentication in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/jumpserver/jumpserver | 3.5.6+incompatible, 3.6.5+incompatible | GO-2025-3570 |
| Go | github.com/jumpserver/koko | no fix listed | GO-2025-3570 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jumpserver | jumpserver | >= 3.6.0, < 3.6.5< 3.5.6 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L