The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability
    and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks)
    property. This allows attackers to create new valid signatures different from previous signatures for a
    known message. (CVE-2020-36843)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2472-1 advisory.

    This update for apache-sshd, jpgpj fixes the following issues

    - CVE-2020-36843: no check performed on scalar to avoid signature malleability (bsc#1239551).
    - CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git (bsc#1267018).

    Changes for jpgpj:

    - Initial packaging with v1.3

    Changes for apache-sshd:

    - Update to upstream version 2.18.0
     * Bug Fixes      + GH-743 Ensure the Java ServiceLoader use a singleton      SftpFileSystemProvider      + GH-879 Close SSH channel gracefully on exception in port      forwarding      + Security: Improve handling of repository paths in sshd-git.
     Resolves CVE-2026-48827, bsc#1267018
     * New Features      + GH-892 Align handling certificates without principals with      OpenSSH 10.3
    - Update to upstream version 2.17.1
     * Changes      + GH-875 Use Apache Parent POM 36
    - Update to upstream version 2.17.0      + GH-469, SSHD-897 Fix duplicate character echo with interactive      shells      + GH-721 SSH client: schedule session timeout checks on demand      only      + GH-807 Handle 'verified' flag for sk-* keys      + GH-809 Fix server-side authentication for FIDO/U2F sk-* keys      with flags in authorized_keys      + GH-827 Don't fail on invalid known_hosts lines; log and skip      them      + GH-830 EC public keys: let Bouncy Castle generate X.509      encodings with the curve OID as algorithm parameter      + GH-855 SFTP: use a single SftpClient per SftpFileSystem      + GH-856 Fix using ed25519 with BC-FIPS      + GH-861 SFTP client: prevent sending zero-length writes in      SftpOutputStreamAsync      + SSHD-1348 Fix zero-length SFTP reads      + SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when      compiling on Java 26-ea      + GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in      optional dependency net.i2p.crypto:eddsa:0.3.0: perform the      missing range check in Apache MINA SSHD before delegating to      the signature verification in net.i2p.crypto:eddsa:0.3.0.
     This means that using net.i2p.crypto:eddsa:0.3.0 in Apache      MINA SSHD is safe despite that CVE in the dependency.
     + GH-865 replace %h in HostName SSH config
    - Update to upstream version 2.16.0
     * Changes of version 2.16.0      + bugfix: fix cert auth failed bug      + GH-664: Skip MAC negotiation if an AEAD cipher was negotiated      + GH-663: Fix a race in IoSession creation      + Also test sshd-mina using mina-core 2.2.4      + ScpShell fixes; SFTP append mode for buggy servers      + fix sources.jar Reproducible Builds issue      + GH-700: Fix race in AbstractCloseable.doCloseImmediately()      + GH-705: Make ChannelToPortHandler accessible to user code      + GH-709: Handle keep-alive channel messages sent by an old      OpenSSH server      + GH-727: supply default port for proxyJump if no      HostConfigEntry      + GH-733: Fix SftpRemotePathChannel.transferTo      + GH-725: Added commandTimeoutMillis in executeRemoteCommand      + GH-774: Fix WritePendingException      + #771 Avoid NoClassDefFoundError:
     net/i2p/crypto/eddsa/EdDSAPublicKey      + GH-516: Fix filesystem-id parsing in getFileSystem(URI)      + GH-754: Don't close DefaultForwarder on bind error      + Close repository after usage in GitPackCommand      + Trigger ClientChannelEvent.Timeout and      ClientSessionEvent.TIMEOUT independently to host's program      cycle times
     * Changes of version 2.15.0      + GH-618: Fix reading an OpenSshCertificate from a Buffer      + Add interface to configure details of JGit's pack      implementation      + ML-KEM key exchanges using Bouncy Castle 1.79      + GH-628: Fix reading directories with trailing blanks in the      name      + GH-626: Enable Streaming.Async for ChannelDirectTcpip      + Sftp server 'ls' command timeout      + GH-636: Handle unknown key types in known_hosts      + GH-643: provide interfaces for caching file attributes on      paths      + Bouncy Castle EdDSA / Ed25519 Support      + Abstract revoked key handling in KnownHostsServerKeyVerifier
    - Fix an incompletely interpolated dependency with maven 4.0.0-rc-4
    - Fix wrong invocation of xmvn-subst
    - Updated to upstream version 2.14.0
    - Changes in version 2.14.0      + GH-524 Performance improvements      + GH-533 Fix multi-step authentication      + GH-582 Fix filtering in NamedFactory      + GH-587 Prevent NullPointerExceptionon closed channel in      NettyIoSession      + GH-590 Better support for FIPS      + GH-597 Pass on Charset in      ClientSession.executeRemoteCommand()      + New utility methods SftpClient.put(Path localFile, String      remoteFileName) and SftpClient.put(InputStream in, String      remoteFileName) facilitate SFTP file uploading.
     * GH-590 Better support for FIPS      Besides fixing a bug with bc-fips (the RandomGenerator class      exists in normal Bouncy Castle, but not in the FIPS version,      but Apache MINA sshd referenced it even if only bc-fips was      present), support was improved for running in an environment      restricted by FIPS.
     There is a new system property      org.apache.sshd.security.fipsEnabled. If set to true, a number      of crypto-algorithms not approved by FIPS 140 are disabled:
     + key exchange methods sntrup761x25519-sha512,      sntrup761x25519-sha512@openssh.com, curve25519-sha256,      curve25519-sha256@libssh.org, curve448-sha512.
     + the chacha20-poly1305 cipher.
     + the bcrypt KDF used in encrypted private key files in      OpenSSH format.
     + all ed25519 keys and signatures.
     Additionally, the new 'SunJCEWrapper' SecurityProviderRegistrar      (see below) and the EdDSASecurityProviderRegistrar are      disabled, and the BouncyCastleScurityProviderRegistrar looks      only for the 'BCFIPS' security provider, not for the normal      'BC' provider.
     If the system property is not set to true, FIPS mode can be      enabled programmatically by calling SecurityUtils.setFipsMode()      before any other call to Apache MINA sshd.
     * Potential compatibility issues      + New security provider registrar      There is a new SecurityProviderRegistrar that is registered      by default if there is a SunJCE security provider. It uses      the AES and HmacSHA* implementations from SunJCE even if      Bouncy Castle is also registered. SunJCE has native      implementations, whereas Bouncy Castle may not.
     The new registrar has the name 'SunJCEWrapper' and can be      configured like any other registrar. It can be disabled via      the system property      org.apache.sshd.security.provider.SunJCEWrapper.enabled=false.
     It is also disabled in FIPS mode (see above).
     The methods NamedFactory.setupBuiltinFactories(boolean      ignoreUnsupported, ...) and      NamedFactory.setupTransformedFactories(boolean      ignoreUnsupported, ...) had a bug that gave the      'ignoreUnsupported' parameter actually the meaning of      'include unsupported'.
     This was fixed in this release, but existing code calling      these or one of the following methods:
     ~ BaseBuilder.setUpDefaultMacs(boolean ignoreUnsupported)      ~ BaseBuilder.setUpDefaultCiphers(boolean ignoreUnsupported)      ~ ClientBuilder.setUpDefaultCompressionFactories(boolean      ignoreUnsupported)      ~ ClientBuilder.setUpDefaultKeyExchanges(boolean      ~ ClientBuilder.setUpDefaultSignatureFactories(boolean      ~ ServerBuilder.setUpDefaultCompressionFactories(boolean      ~ ServerBuilder.setUpDefaultKeyExchanges(boolean      ~ ServerBuilder.setUpDefaultSignatureFactories(boolean      ~ any of the methods starting with      SshConfigFileReader.configure      ~ SshClientConfigFileReader.configure(...)      ~ SshServerConfigFileReader.configure(...)      should be reviewed:
     ~ if the method is called with parameter value true, the      result will no longer include unsupported algorithms.
     Formerly it wrongly did.
     ~ if the method is called with parameter value false, the      result may include unsupported algorithms. Formerly it      did not.
     So if existing code used parameter value false to ensure it      never got unsupported algorithms, change it to true.
     * Major Code Re-factoring      + JDK requirements      ~ GH-536 The project now requires JDK 17 at build time, while      the target runtime still remains unchanged to support JDK      8.
    - Changes in version 2.13.2
     * What's Changed      + GH-525: Fix sntrup761x25519-sha512 by @tomaswolf in #528
    - Changes in version 2.13.1      + This release does not contain any code changes. It is solely      to rectify the issue that the 2.13.0 release encountered      during the release process, where the source jars were not      created.
    - Changes in version 2.13.0      + GH-318: Handle cascaded proxy jumps by @tomaswolf in #512      + GH-427: Read initial ACK on channel open prior to direct      stream upload & close streams prior to exit code handling by      @TerraNibble in #464      + GH-455: ensure BaseCipher.update() fulfills the contract by      @tomaswolf in #463      + GH-470: Synchronize not thread safe      java.security.KeyPairGenerator.generateKe... by      @zakharovsergey1000 in #467      + GH-476: Fix Android detection false negative by @wh0      + GH-475: Switch uses of JSch library to the      com.github.mwiede:jsch fork by @Alex-Vol-Amz      + GH-472: change client start condition in sshd-spring-sftp by      @alwaystom      + GH-489: sftp readdir: determine file type from longname by      @tomaswolf in #491      + GH-486: Add missing U2F {ed25519,ecdsa}-sk public key      equality methods by @lf-      + SSHD-1237 Handle keep-alive channel requests by @tomaswolf in      #492      + GH-494: Nio2Session improvements by @evgeny-pasynkov      + GH-468: Handle excess data in SFTP read requests by      @tomaswolf in #495      + GH-498: Implement the 'sntrup761x25519-sha512@openssh.com'      KEX method by @tomaswolf      + GH-500: SftpFileSystemProvider: close SftpClient on exception      by @tomaswolf in #501      + GH-504: Pass reason to sessionNegotiationEnd by @duco-lw in      #505      + GH-461: Fix heartbeats with wantReply=true by @tomaswolf in      #507      + GH-493: Fix arcfour128 and arcfour256 ciphers (regression in      2.2.0)      + GH-509: SFTP v[456] client: validate attribute flags      + GH-510: Fix class name in BuiltinIoServiceFactoryFactories      (regression in 2.6.0)      + sntrup761x25519-sha512@openssh.com Key Exchange      The key exchange method sntrup761x25519-sha512@openssh.com is      now available if the Bouncy Castle library is available.
     This uses a post-quantum key encapsulation method (KEM) to      make key exchange future-proof against quantum attacks.
     More information can be found in IETF Memo Secure Shell (SSH)      Key Exchange Method Using Hybrid Streamlined NTRU Prime      sntrup761 and X25519 with SHA-512: sntrup761x25519-sha512.
     + Behavioral changes and enhancements      ~ GH-318 Handle cascaded proxy jumps      Proxy jumps can be configured via host configuration      entries in two ways. First, proxies can be chained directly      by specifiying several proxies in one ProxyJump directive:
     Host target      Hostname somewhere.example.org      User some_user      IdentityFile ~/.ssh/some_id      ProxyJump jumphost2, jumphost1      Host jumphost1      Hostname jumphost1@example.org      User jumphost1_user      IdentityFile ~/.ssh/id_jumphost1      Host jumphost2      Hostname jumphost2@example.org      User jumphost2_user      IdentityFile ~/.ssh/id_jumphost2      Connecting to server target will first connect to      jumphost1, then tunnel through to jumphost2, and finally      tunnel to target. So the full connection will be      client->jumphost1->jumphost2->target.
     Such proxy jump chains were already supported in Apache      MINA SSHD.
     Newly, Apache MINA SSHD also supports cascading proxy      jumps, so a configuration like      ProxyJump jumphost2      ProxyJump jumphost1      also works now, and produces the same connection      It is possible to mis-configure such proxy jump cascades to      have loops. (For instance, if host jumphost1 in the above      example had a ProxyJump jumphost2 directive.) To catch such      misconfigurations, Apache MINA SSHD imposes an upper limit      on the total number of proxy jumps in a connection. An      exception is thrown if there are more than      CoreModuleProperties.MAX_PROXY_JUMPS proxy jumps in a      connection. The default value of this property is 10. Most      real uses of proxy jumps will have one or maybe two proxy      jumps only.
     ~ GH-461 Fix heartbeats with wantReply=true      The client-side heartbeat mechanism has been updated. Such      heartbeats are configured via the      CoreModuleProperties.HEARTBEAT_INTERVAL property. If this      interval is > 0, heartbeats are sent to the server.
     Previously these heartbeats could also be configured with a      CoreModuleProperties.HEARTBEAT_REPLY_WAIT timeout. If the      timeout was <= 0, the client would just send heartbeat      requests without expecting any answers. If the timeout was      > 0, the client would send requests with a flag indicating      that the server should reply. The client would then wait      for the specified duration for the reply and would      terminate the connection if none was received.
     This mechanism could cause trouble if the timeout was      fairly long and the server was slow to respond. A timeout      longer than the interval could also delay subsequent      heartbeats.
     The CoreModuleProperties.HEARTBEAT_REPLY_WAIT property is      now deprecated.
     There is a new configuration property      CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX instead. It      defines a limit for the number of heartbeats sent without      receiving a reply before a session is terminated. If the      value is <= 0, the client still sends heartbeats without      expecting any reply. If the value is > 0, the client will      request a reply from the server for each heartbeat message,      and it will terminate the connection if the number of      unanswered heartbeats reaches      CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX.
     This new way to configure heartbeats aligns with the      OpenSSH configuration options ServerAliveInterval and      ServerAliveCountMax.
     For compatibility with older configurations that explicitly      define CoreModuleProperties.HEARTBEAT_REPLY_WAIT, the new      code maps this to the new configuration (but only if      CoreModuleProperties.HEARTBEAT_INTERVAL > 0 and the new      property CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX has      not been set) by setting      CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX to      = CoreModuleProperties.HEARTBEAT_REPLY_WAIT <= 0:
     CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX = 0      = otherwise: (CoreModuleProperties.HEARTBEAT_REPLY_WAIT /      CoreModuleProperties.HEARTBEAT_INTERVAL) + 1.
     ~ GH-468 SFTP: validate length of data received: must not be      more than requested      SFTP read operations now check the amount of data they get      back. If it's more than requested an exception is thrown.
     SFTP servers must never return more data than the client      requested, but it appears that there are some that do so.
     If property SftpModuleProperties.TOLERATE_EXCESS_DATA is      set to true, a warning is logged and such excess data is      silently discarded.
     + AES-CBC ciphers removed from server's defaults      The AES-CBC ciphers aes128-cbc, aes192-cbc, and aes256-cbc      have been removed from the default list of cipher algorithms      that a server proposes in the key exchange. OpenSSH has      removed these cipher algorithms from the server proposal in      2014, and has removed them from the client proposal in 2017.
     The cipher implementations still exist but they are not      enabled by default. Existing code that explicitly sets the      cipher factories is unaffected. Code that relies on the      default settings will newly create a server that does not      support the CBC-mode ciphers. To enable the CBC-mode ciphers,      one can use for instance      SshServer server = ServerBuilder.builder()      ...
     .cipherFactories(BuiltinFactory.setUpFactories(false,      BaseBuilder.DEFAULT_CIPHERS_PREFERENCES));
     .build();
     For the SSH client, the CBC ciphers are still enabled by      default to facilitate connecting to legacy servers. We plan      to remove the CBC ciphers from the client's defaults in the      next release.
    - Changes in version 2.12.1      + GH-458 Singleton thread pool for kex message handler flushing      + SSHD-1338 Restore binary compatibility with 2.9.2      + Fix link by @swiedenfeld in #454      + SSHD-1338 Restore binary compatibility with 2.9.2 by @gnodet      in #456      + Use a singleton threadpool for kex message handler flushing      by @FliegenKLATSCH in #459
    - Enable module: sshd-openpgp
    - Add an 'extras' flavour to build without cycles all modules we      can

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016772 advisory.

    The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability     and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks)     property. This allows attackers to create new valid signatures different from previous signatures for a     known message.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability     and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks)     property. This allows attackers to create new valid signatures different from previous signatures for a     known message. (CVE-2020-36843)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Security-in-Depth issue in the Oracle Database Grid (Apache Tomcat) component of Oracle Database     Server. This vulnerability cannot be exploited in the context of this product. (CVE-2025-24813)

  - Vulnerability in the Oracle Database (OpenSSL) component of Oracle Database Server.  Supported versions     that are affected are 23.4-23.7. Easily exploitable vulnerability allows physical access to compromise     Oracle Database (OpenSSL).  Successful attacks of this vulnerability can result in  unauthorized update,     insert or delete access to some of Oracle Database (OpenSSL) accessible data as well as  unauthorized read     access to a subset of Oracle Database (OpenSSL) accessible data and unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle Database (OpenSSL). CVSS 3.1 Base Score 4.3 (Confidentiality,     Integrity and Availability impacts). (CVE-2024-9143)

  - Vulnerability in the Oracle Database SQLCl (EdDSA) component of Oracle Database Server.  Supported versions     that are affected are 23.4-23.7. Easily exploitable vulnerability allows unauthenticated attacker with logon     to the infrastructure where Oracle Database SQLCl (EdDSA) executes to compromise Oracle Database SQLCl     (EdDSA).  While the vulnerability is in Oracle Database SQLCl (EdDSA), attacks may significantly impact     additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Database SQLCl (EdDSA) accessible data. (CVE-2020-36843)

  - Vulnerability in the Oracle Database (OpenSSL) component of Oracle Database Server.  Supported versions     that are affected are 23.4-23.7. Easily exploitable vulnerability allows physical access to compromise     Oracle Database (OpenSSL).  Successful attacks of this vulnerability can result in  unauthorized update,     insert or delete access to some of Oracle Database (OpenSSL) accessible data as well as  unauthorized     read access to a subset of Oracle Database (OpenSSL) accessible data and unauthorized ability to cause     a partial denial of service (partial DOS) of Oracle Database (OpenSSL). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1029-1 advisory.

    - CVE-2020-36843: Fixed no check performed on scalar to avoid signature malleability (bsc#1239551)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability     and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks)     property. This allows attackers to create new valid signatures different from previous signatures for a     known message. (CVE-2020-36843)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
464879	Echo: net.i2p.crypto:eddsa: security update to 0.3.0-2.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464879	Echo: net.i2p.crypto:eddsa: security update to 0.3.0-2.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
321925	SUSE SLED15 / SLES15 Security Update : apache-sshd, jpgpj (SUSE-SU-2026:2472-1)	Nessus	SuSE Local Security Checks	Local	medium
316176	Unity Linux 20.1050e / 20.1070e Security Update: ed25519-java (UTSA-2026-016772)	Nessus	Unity Linux Local Security Checks	Local	medium
257079	Linux Distros Unpatched Vulnerability : CVE-2020-36843	Nessus	Misc.	Local	medium
234618	Oracle Database Server (April 2025 CPU)	Nessus	Databases	Local	high
233409	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ed25519-java (SUSE-SU-2025:1029-1)	Nessus	SuSE Local Security Checks	Local	medium
232871	Jenkins plugins Multiple Vulnerabilities (2025-03-19)	Nessus	CGI abuses	Combined	medium
421119	SCA: security update for net.i2p:i2p (GHSA-p53j-g8pw-4w5f)	Tenable Cloud Security	SCA Checks	Local	medium
421119	SCA: security update for net.i2p:i2p (GHSA-p53j-g8pw-4w5f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2020-36843

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium