CVE-2020-36843

EUVD-2025-6277
The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
apache-sshd
suse enterprise desktop 15 SP7
2.18.0-150200.5.11.1
fixed
suse enterprise sap 15 SP4
2.18.0-150200.5.11.1
fixed
suse enterprise sap 15 SP5
2.18.0-150200.5.11.1
fixed
suse enterprise sap 15 SP6
2.18.0-150200.5.11.1
fixed
suse enterprise sap 15 SP7
2.18.0-150200.5.11.1
fixed
suse enterprise server 15 SP4
2.18.0-150200.5.11.1
fixed
suse enterprise server 15 SP5
2.18.0-150200.5.11.1
fixed
suse enterprise server 15 SP6
2.18.0-150200.5.11.1
fixed
suse enterprise server 15 SP7
2.18.0-150200.5.11.1
fixed
ed25519-java
suse enterprise desktop 15 SP7
0.3.0-150200.5.9.1
fixed
suse enterprise sap 15 SP4
0.3.0-150200.5.9.1
fixed
suse enterprise sap 15 SP5
0.3.0-150200.5.9.1
fixed
suse enterprise sap 15 SP7
0.3.0-150200.5.9.1
fixed
suse enterprise server 15 SP4
0.3.0-150200.5.9.1
fixed
suse enterprise server 15 SP5
0.3.0-150200.5.9.1
fixed
suse enterprise server 15 SP7
0.3.0-150200.5.9.1
fixed
jpgpj
suse enterprise desktop 15 SP7
1.3-150200.5.3.1
fixed
suse enterprise sap 15 SP4
1.3-150200.5.3.1
fixed
suse enterprise sap 15 SP5
1.3-150200.5.3.1
fixed
suse enterprise sap 15 SP6
1.3-150200.5.3.1
fixed
suse enterprise sap 15 SP7
1.3-150200.5.3.1
fixed
suse enterprise server 15 SP4
1.3-150200.5.3.1
fixed
suse enterprise server 15 SP5
1.3-150200.5.3.1
fixed
suse enterprise server 15 SP6
1.3-150200.5.3.1
fixed
suse enterprise server 15 SP7
1.3-150200.5.3.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
ed25519-java
Azure Linux 3.0
0:0.3.0-1.azl3
fixed
Common Weakness Enumeration
References
https://eprint.iacr.org/2020/1244
https://github.com/str4d/ed25519-java/issues/82#issue-727629226