SUSE CVE-2023-42818

🗓️ 04 Jul 2025 14:55:55Reported by Suse CVEType

JumpServer Koko SSH bypasses key verification with public keys used for MFA, enabling brute-force attacks; upgrade to fixed versions.

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	The vulnerability of the component Koko in the system for auditing the security operations and maintenance of JumpServer, which allows a perpetrator to bypass the authentication process	29 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-42818	28 Sep 202300:41	–	circl
CNNVD	Jumpserver Authorization Issues Vulnerability	27 Sep 202300:00	–	cnnvd
CVE	CVE-2023-42818	27 Sep 202320:28	–	cve
Cvelist	CVE-2023-42818 SSH public key login without private key challenge if mfa is enabled in jumpserver	27 Sep 202320:28	–	cvelist
EUVD	EUVD-2023-47240	3 Oct 202520:07	–	euvd
NVD	CVE-2023-42818	27 Sep 202321:15	–	nvd
OPENSUSE Linux	govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media (moderate)	5 Jul 202500:00	–	opensuse
OSV	CVE-2023-42818 SSH public key login without private key challenge if mfa is enabled in jumpserver	27 Sep 202320:28	–	osv
OSV	GO-2025-3570 SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver	12 Jun 202514:09	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
OpenSUSE Tumbleweed	–	any	govulncheck-vulndb	0.0.20250612T141001-1.1	govulncheck-vulndb-0.0.20250612T141001-1.1.noarch.rpm
SUSE Linux Enterprise Server	16.0	any	govulncheck-vulndb	0.0.20250814T182633-160000.1.2	govulncheck-vulndb-0.0.20250814T182633-160000.1.2.noarch.rpm

Source	Link
suse	www.suse.com/security/cve/CVE-2023-42818
suse	www.suse.com/support/security/rating/

15 May 2026 02:05Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19.8

EPSS0.00582