CVE-2020-36843

🗓️ 13 Mar 2025 00:00:00Reported by mitreType

Implementation of EdDSA-Java has signature malleability, violating Strong Existential Unforgeability.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to Improper Verification of Cryptographic Signature in SSHJ (CVE-2020-36843)	18 Jun 202519:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to Improper Verification of Cryptographic Signature due to EdDSA (CVE-2020-36843)	30 Sep 202515:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard could allow attackers to create new valid signatures different from previous signatures for a known message CVE-2020-36843	15 Aug 202516:08	–	ibm
CBLMariner	CVE-2020-36843 affecting package ed25519-java for versions less than 0.3.0-1	13 Jan 202601:11	–	cbl_mariner
Chainguard	CVE-2020-36843 vulnerabilities	20 Mar 202504:12	–	cgr
Circl	CVE-2020-36843	13 Mar 202505:44	–	circl
CNNVD	EdDSA-Java 安全漏洞	13 Mar 202500:00	–	cnnvd
Cvelist	CVE-2020-36843	13 Mar 202500:00	–	cvelist
Debian CVE	CVE-2020-36843	13 Mar 202500:00	–	debiancve
EUVD	EUVD-2025-6277	3 Oct 202520:07	–	euvd

Vulners

Node

str4d ed25519-javaRange0–0.3.0

[
  {
    "defaultStatus": "unknown",
    "product": "ed25519-java",
    "vendor": "str4d",
    "versions": [
      {
        "lessThanOrEqual": "0.3.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
eprint	www.eprint.iacr.org/2020/1244
github	www.github.com/str4d/ed25519-java/issues/82

15 Apr 2026 00:35Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.3

EPSS0.00028

SSVC

CWE-347