SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver

緊急 9.8CVE-2023-42818 · GHSA-jv3c-27cv-w8jv · GO-2025-3570 · 27/09/2023 公開 · 17/06/2026 更新

要点

CVE-2023-42818 は github.com/jumpserver/jumpserver, github.com/jumpserver/koko, jumpserver (fit2cloud) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.68%（全脆弱性の 52.2% より高い）。
対処：3.6.5+incompatible, 3.5.6+incompatible, 3.6.5, 3.5.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/jumpserver/jumpserver Go	`≥ 3.6.0+incompatible, < 3.6.5+incompatible< 3.5.6+incompatible`	`3.6.5+incompatible3.5.6+incompatible`
github.com/jumpserver/koko Go	`全バージョン`	修正版なし
jumpserver fit2cloud	`≥ 3.6.0, < 3.6.5< 3.5.6`	`3.6.53.5.6`

概要

SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver

NVD の説明

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.