CVE-2020-36843: str4d ed25519-java
CVSS: 4.3v3.1MediumDeferred
AliasesSUSE-SU-2025:1029-1UBUNTU-CVE-2020-36843DEBIAN-CVE-2020-36843CGA-24c8-r782-hf3jCGA-35f4-3rfh-37v8CGA-5h59-j925-8vp8CGA-6pgr-5x4f-cqv6CGA-6w67-wg56-2874CGA-732v-2c96-7xw8CGA-85vg-35gj-ffh3CGA-9pf8-v9mf-x26vCGA-c6hw-mh8m-c3rjCGA-cp2q-gv74-c5wwCGA-cwfq-vpm2-jxfhCGA-fj8q-fp8p-3qq7CGA-g98x-8r72-x3fpCGA-hvvp-9wrf-qq23CGA-j6ch-8qm8-jr82CGA-m528-45wj-7p88CGA-mq96-jr29-rm2mCGA-mrqm-q276-4phgCGA-pp5x-53w4-g2f2CGA-wrw5-fxmw-44wqopenSUSE-SU-2025:14892-1CGA-2c9w-x34w-cpqxCGA-2jg6-78vh-3856CGA-2prp-x2rf-7rrxCGA-2qr3-mqq4-v49hCGA-32mf-frpw-ff84CGA-3w62-qgxc-84fpCGA-4qr9-4x35-574fCGA-5hrf-q49r-v9rgCGA-66f5-6474-7cf5CGA-7g8x-hp7w-cq6fCGA-838v-mc58-hp36CGA-8r5c-jjgq-88vcCGA-9cw5-qpp9-rwxrCGA-c3m8-v9vw-qrg8CGA-c6r8-mjv2-m9pvCGA-ccmc-cpgg-m3pmCGA-cm49-mr7q-96cgCGA-cvm6-339q-5rffCGA-cwmp-m262-wg39CGA-f65v-58hf-mqr2CGA-fjxc-76q3-v6rvCGA-g68m-35mm-225vCGA-gvvf-6c9r-hvc5CGA-h97g-wwcx-8w3cCGA-h9q2-c3g5-q6wcCGA-hcvc-8f49-fm3pCGA-hp82-2v85-qq53CGA-hvg2-qm2x-62grCGA-hx4r-xhj5-hqwfCGA-jf4p-c328-877cCGA-jg62-c6mr-f5xhCGA-jhg3-rp7j-2frgCGA-jjgq-3x64-rjrvCGA-m9h7-j9jv-fcg2CGA-mh6m-45xc-h669CGA-mvrv-xph7-cc9jCGA-p6xp-g3hh-6m38CGA-pcfg-qrh4-j87qCGA-pq35-2mmx-8qv2GHSA-p53j-g8pw-4w5fCGA-qm88-8r83-2pw9CGA-qw52-m6x2-pwrqCGA-rr5g-2fwp-qx5gCGA-v58g-rrgw-7p2wCGA-vm2v-2rfr-pqj7CGA-x2g9-8cc4-8vmxCGA-x6m6-x7w4-xrf9CGA-x88p-f78j-f5rvCGA-xf5g-g4rh-2cpjCGA-xmh4-fr6c-3gr5CGA-xq33-v2qm-wj7x
Published 13-03-2025Last modified 18-03-2025
Vulnerability summary
CVE-2020-36843 is a medium (CVSS 4.3) vulnerability in str4d ed25519-java. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.2% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.14%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 13-03-2025PublishedVulnerability first disclosed.
- 18-03-2025Last modifiedVulnerability information updated.
Description
The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.14% on 19-09-2026
19-09-202619-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard34 products
- conductor< 3.31.0-r4
- conductor-fips< 3.31.0-r5
- eco-java-gradle-7.6.5All versions (No fix recorded)
- eco-java-gradle-7.6.6All versions (No fix recorded)
- eco-java-gradle-8.10All versions (No fix recorded)
Suse13 products
- ed25519-java&distro=SUSE Enterprise Storage 7.1< 0.3.0-150200.5.9.1
- ed25519-java&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 0.3.0-150200.5.9.1
- ed25519-java&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 0.3.0-150200.5.9.1
- ed25519-java&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 0.3.0-150200.5.9.1
- ed25519-java&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 0.3.0-150200.5.9.1
Wolfi9 products
- gradle-8< 8.14.3-r5 | < 8.14.5-r3
- jenkins-2-openjdk-21< 2.544-r1
- sonarqubeAll versions (No fix recorded)
- sonarqube-10All versions (No fix recorded)
- thingsboard< 3.9.1-r2
Opensuse2 products
- ed25519-java&distro=openSUSE Leap 15.6< 0.3.0-150200.5.9.1
- ed25519-java&distro=openSUSE Tumbleweed< 0.3.0-6.1
Ubuntu2 products
- libeddsa-javaAll versions (No fix recorded)
- ruby-ed25519All versions (No fix recorded)
Debian1 product
- libeddsa-java< 0.3.0-2.1
Net.i2p1 product
- i2p< 0.9.39
Net.i2p.crypto1 product
- eddsa≤ 0.3.0
Str4d1 product
- ed25519-java≤ 0.3.0
9 vendors · 64 products
References
12 links
- lists.opensuse.org/archives/…Advisory
