CVE-2020-36843

The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

References

Affected packages

Debian:13 / libeddsa-java

Package

Name: libeddsa-java
Purl: pkg:deb/debian/libeddsa-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.0-2.1

Affected versions

0.*

0.3.0-1

0.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/str4d/ed25519-java

Affected ranges

Type: GIT
Repo: https://github.com/str4d/ed25519-java
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

7c26a6312c2d2e887210930698706103e0f2da7d

Affected versions

v0.*

v0.1.0

v0.3.0