CVE-2020-36843

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

This is an implementation of EdDSA in Java. Structurally, it is based on the ref10 implementation in SUPERCOP (see http://ed25519.cr.yp.to/software.html). There are two internal implementations: * A port of the radix-2^51 operations in ref10 - fast and constant-time, but only useful for Ed25519. * A generic version using BigIntegers for calculation - a bit slower and not constant-time, but compatible with any EdDSA parameter specification.

Security Fix(es):

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.(CVE-2020-36843)

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

TuxCare rebuilt net.i2p.crypto:eddsa to address 1 CVE. Fixed in 0.3.0-tuxcare.1.

These are all security issues fixed in the ed25519-java-0.3.0-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache-sshd-2.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ed25519-java fixes the following issues:

• CVE-2020-36843: Fixed no check performed on scalar to avoid signature malleability (bsc#1239551)

This update for apache-sshd, jpgpj fixes the following issues

• CVE-2020-36843: no check performed on scalar to avoid signature malleability (bsc#1239551).
• CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git (bsc#1267018).

Changes for jpgpj:

• Initial packaging with v1.3

Changes for apache-sshd:

• Update to upstream version 2.18.0

• Bug Fixes

• GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
• GH-879 Close SSH channel gracefully on exception in port forwarding
• Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, bsc#1267018

• New Features

• GH-892 Align handling certificates without principals with OpenSSH 10.3

• Update to upstream version 2.17.1

• Changes

• GH-875 Use Apache Parent POM 36

• Update to upstream version 2.17.0

• GH-469, SSHD-897 Fix duplicate character echo with interactive shells
• GH-721 SSH client: schedule session timeout checks on demand only
• GH-807 Handle 'verified' flag for sk-* keys
• GH-809 Fix server-side authentication for FIDO/U2F sk-* keys with flags in authorized_keys
• GH-827 Don't fail on invalid known_hosts lines; log and skip them
• GH-830 EC public keys: let Bouncy Castle generate X.509 encodings with the curve OID as algorithm parameter
• GH-855 SFTP: use a single SftpClient per SftpFileSystem
• GH-856 Fix using ed25519 with BC-FIPS
• GH-861 SFTP client: prevent sending zero-length writes in SftpOutputStreamAsync
• SSHD-1348 Fix zero-length SFTP reads
• SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when compiling on Java 26-ea
• GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in optional dependency net.i2p.crypto:eddsa:0.3.0: perform the missing range check in Apache MINA SSHD before delegating to the signature verification in net.i2p.crypto:eddsa:0.3.0. This means that using net.i2p.crypto:eddsa:0.3.0 in Apache MINA SSHD is safe despite that CVE in the dependency.
• GH-865 replace %h in HostName SSH config

• Update to upstream version 2.16.0

• Changes of version 2.16.0

• bugfix: fix cert auth failed bug
• GH-664: Skip MAC negotiation if an AEAD cipher was negotiated
• GH-663: Fix a race in IoSession creation
• Also test sshd-mina using mina-core 2.2.4
• ScpShell fixes; SFTP append mode for buggy servers
• fix sources.jar Reproducible Builds issue
• GH-700: Fix race in AbstractCloseable.doCloseImmediately()
• GH-705: Make ChannelToPortHandler accessible to user code
• GH-709: Handle keep-alive channel messages sent by an old OpenSSH server
• GH-727: supply default port for proxyJump if no HostConfigEntry
• GH-733: Fix SftpRemotePathChannel.transferTo
• GH-725: Added commandTimeoutMillis in executeRemoteCommand
• GH-774: Fix WritePendingException
• #771 Avoid NoClassDefFoundError: net/i2p/crypto/eddsa/EdDSAPublicKey
• GH-516: Fix filesystem-id parsing in getFileSystem(URI)
• GH-754: Don't close DefaultForwarder on bind error
• Close repository after usage in GitPackCommand
• Trigger ClientChannelEvent.Timeout and ClientSessionEvent.TIMEOUT independently to host's program cycle times

• Changes of version 2.15.0

• GH-618: Fix reading an OpenSshCertificate from a Buffer
• Add interface to configure details of JGit's pack implementation
• ML-KEM key exchanges using Bouncy Castle 1.79
• GH-628: Fix reading directories with trailing blanks in the name
• GH-626: Enable Streaming.Async for ChannelDirectTcpip
• Sftp server 'ls' command timeout
• GH-636: Handle unknown key types in known_hosts
• GH-643: provide interfaces for caching file attributes on paths
• Bouncy Castle EdDSA / Ed25519 Support
• Abstract revoked key handling in KnownHostsServerKeyVerifier

• Fix an incompletely interpolated dependency with maven 4.0.0-rc-4
• Fix wrong invocation of xmvn-subst
• Updated to upstream version 2.14.0
• Changes in version 2.14.0

• GH-524 Performance improvements
• GH-533 Fix multi-step authentication
• GH-582 Fix…