Medium severity4.3OSV Advisory· Published Mar 13, 2025· Updated Apr 15, 2026

CVE-2020-36843

Description

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
net.i2p.crypto:eddsaMaven	<= 0.3.0	—
net.i2p:i2pMaven	< 0.9.39	0.9.39

Affected products

Str4d/Ed25519 JavaOSV
Range: v0.1.0, v0.3.0
osv-coords52 versions
pkg:apk/chainguard/jenkins-2-openjdk-21 pkg:apk/chainguard/thingsboard pkg:apk/chainguard/thingsboard-tb-js-executor pkg:apk/chainguard/thingsboard-tb-mqtt-transport pkg:apk/chainguard/thingsboard-tb-node pkg:apk/chainguard/thingsboard-tb-web-ui pkg:apk/wolfi/jenkins-2-openjdk-21 pkg:apk/wolfi/thingsboard pkg:apk/wolfi/thingsboard-tb-js-executor pkg:apk/wolfi/thingsboard-tb-mqtt-transport pkg:apk/wolfi/thingsboard-tb-node pkg:apk/wolfi/thingsboard-tb-web-ui pkg:maven/net.i2p.crypto/eddsa pkg:maven/net.i2p/i2p pkg:rpm/opensuse/apache-sshd&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ed25519-java&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/ed25519-java&distro=openSUSE%20Tumbleweed pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/apache-sshd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/ed25519-java&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/ed25519-java&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/jpgpj&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6
< 2.544-r1+ 51 more
- (no CPE)range: < 2.544-r1
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 2.544-r1
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: < 3.9.1-r2
- (no CPE)range: <= 0.3.0
- (no CPE)range: < 0.9.39
- (no CPE)range: < 2.18.0-1.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-6.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 2.18.0-150200.5.11.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 0.3.0-150200.5.9.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1
- (no CPE)range: < 1.3-150200.5.3.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p53j-g8pw-4w5fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-36843ghsaADVISORY
eprint.iacr.org/2020/1244nvdWEB
github.com/i2p/i2p.i2p/commit/d7d1dcb5399c61cf2916ccc45aa25b0209c88712ghsaWEB
github.com/str4d/ed25519-java/issues/82nvdWEB

News mentions

Jenkins Security Advisory 2025-03-19
Jenkins Security Advisories · Mar 19, 2025

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000