{
  "cveId": "CVE-2020-36843",
  "url": "https://patchblox.com/security/cve/CVE-2020-36843",
  "summary": "CVE-2020-36843 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2020-36843, released March 13, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apache-sshd: This update for apache-sshd, jpgpj fixes the following issues\n\n- CVE-2020-36843: no check performed on scalar to avoi...",
  "description": "This update for apache-sshd, jpgpj fixes the following issues\n\n- CVE-2020-36843: no check performed on scalar to avoid signature malleability (bsc#1239551).\n- CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git (bsc#1267018).\n\nChanges for jpgpj:\n\n- Initial packaging with v1.3\n\nChanges for apache-sshd:\n\n- Update to upstream version 2.18.0\n * Bug Fixes\n \u002B GH-743 Ensure the Java ServiceLoader use a singleton\n SftpFileSystemProvider\n \u002B GH-879 Close SSH channel gracefully on exception in port\n forwarding\n \u002B Security: Improve handling of repository paths in sshd-git.\n Resolves CVE-2026-48827, bsc#1267018\n * New Features\n \u002B GH-892 Align handling certificates without principals with\n OpenSSH 10.3\n- Update to upstream version 2.17.1\n * Changes\n \u002B GH-875 Use Apache Parent POM 36\n- Update to upstream version 2.17.0\n \u002B GH-469, SSHD-897 Fix duplicate character echo with interactive\n shells\n \u002B GH-721 SSH client: schedule session timeout checks on demand\n only\n \u002B GH-807 Handle \u0027verified\u0027 flag for sk-* keys\n \u002B GH-809 Fix server-side authentication for FIDO/U2F sk-* keys\n with flags in authorized_keys\n \u002B GH-827 Don\u0027t fail on invalid known_hosts lines; log and skip\n them\n \u002B GH-830 EC public keys: let Bouncy Castle generate X.509\n encodings with the curve OID as algorithm parameter\n \u002B GH-855 SFTP: use a single SftpClient per SftpFileSystem\n \u002B GH-856 Fix using ed25519 with BC-FIPS\n \u002B GH-861 SFTP client: prevent sending zero-length writes in\n SftpOutputStreamAsync\n \u002B SSHD-1348 Fix zero-length SFTP reads\n \u002B SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when\n compiling on Java 26-ea\n \u002B GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in\n optional dependency net.i2p.crypto:eddsa:0.3.0: perform the\n missing range check in Apache MINA SSHD before delegating to\n the signature verification in net.i2p.crypto:eddsa:0.3.0.\n This means that using net.i2p.crypto:eddsa:0.3.0 in Apache\n MINA SSHD is safe despite that CVE in the dependency.\n \u002B GH-865 replace %h in HostName SSH config\n- Update to upstream version 2.16.0\n * Changes of version 2.16.0\n \u002B bugfix: fix cert auth failed bug\n \u002B GH-664: Skip MAC negotiation if an AEAD cipher was negotiated\n \u002B GH-663: Fix a race in IoSession creation\n \u002B Also test sshd-mina using mina-core 2.2.4\n \u002B ScpShell fixes; SFTP append mode for buggy servers\n \u002B fix sources.jar Reproducible Builds issue\n \u002B GH-700: Fix race in AbstractCloseable.doCloseImmediately()\n \u002B GH-705: Make ChannelToPortHandler accessible to user code\n \u002B GH-709: Handle keep-alive channel messages sent by an old\n OpenSSH server\n \u002B GH-727: supply default port for proxyJump if no\n HostConfigEntry\n \u002B GH-733: Fix SftpRemotePathChannel.transferTo\n \u002B GH-725: Added commandTimeoutMillis in executeRemoteCommand\n \u002B GH-774: Fix WritePendingException\n \u002B #771 Avoid NoClassDefFoundError:\n net/i2p/crypto/eddsa/EdDSAPublicKey\n \u002B GH-516: Fix filesystem-id parsing in getFileSystem(URI)\n \u002B GH-754: Don\u0027t close DefaultForwarder on bind error\n \u002B Close repository after usage in GitPackCommand\n \u002B Trigger ClientChannelEvent.Timeout and\n ClientSessionEvent.TIMEOUT independently to host\u0027s program\n cycle times\n * Changes of version 2.15.0\n \u002B GH-618: Fix reading an OpenSshCertificate from a Buffer\n \u002B Add interface to configure details of JGit\u0027s pack\n implementation\n \u002B ML-KEM key exchanges using Bouncy Castle 1.79\n \u002B GH-628: Fix reading directories with trailing blanks in the\n name\n \u002B GH-626: Enable Streaming.Async for ChannelDirectTcpip\n \u002B Sftp server \u0027ls\u0027 command timeout\n \u002B GH-636: Handle unknown key types in known_hosts\n \u002B GH-643: provide interfaces for caching file attributes on\n paths\n \u002B Bouncy Castle EdDSA / Ed25519 Support\n \u002B Abstract revoked key handling in KnownHostsServerKeyVerifier\n- Fix an incompletely interpolated dependency with maven 4.0.0-rc-4\n- Fix wrong invocation of xmvn-subst\n- Updated to upstream version 2.14.0\n- Changes in version 2.14.0\n \u002B GH-524 Performance improvements\n \u002B GH-533 Fix multi-step authentication\n \u002B GH-582 Fix filtering in NamedFactory\n \u002B GH-587 Prevent NullPointerExceptionon closed channel in\n NettyIoSession\n \u002B GH-590 Better support for FIPS\n \u002B GH-597 Pass on Charset in\n ClientSession.executeRemoteCommand()\n \u002B New utility methods SftpClient.put(Path localFile, String\n remoteFileName) and SftpClient.put(InputStream in, String\n remoteFileName) facilitate SFTP file uploading.\n * GH-590 Better support for FIPS\n Besides fixing a bug with bc-fips (the RandomGenerator class\n exists in normal Bouncy Castle, but not in the FIPS version,\n but Apache MINA sshd referenced it even if only bc-fips was\n present), support was improved for running in an environment\n restricted by FIPS.\n There is a new system property\n org.apache.sshd.security.fipsEnabled. If set to true, a number\n of crypto-algorithms not approved by FIPS 140 are disabled:\n \u002B key exchange methods sntrup761x25519-sha512,\n sntrup761x25519-sha512@openssh.com, curve25519-sha256,\n curve25519-sha256@libssh.org, curve448-sha512.\n \u002B the chacha20-poly1305 cipher.\n \u002B the bcrypt KDF used in encrypted private key files in\n OpenSSH format.\n \u002B all ed25519 keys and signatures.\n Additionally, the new \u0027SunJCEWrapper\u0027 SecurityProviderRegistrar\n (see below) and the EdDSASecurityProviderRegistrar are\n disabled, and the BouncyCastleScurityProviderRegistrar looks\n only for the \u0027BCFIPS\u0027 security provider, not for the normal\n \u0027BC\u0027 provider.\n If the system property is not set to true, FIPS mode can be\n enabled programmatically by calling SecurityUtils.setFipsMode()\n before any other call to Apache MINA sshd.\n * Potential compatibility issues\n \u002B New security provider registrar\n There is a new SecurityProviderRegistrar that is registered\n by default if there is a SunJCE security provider. It uses\n the AES and HmacSHA* implementations from SunJCE even if\n Bouncy Castle is also registered. SunJCE has native\n implementations, whereas Bouncy Castle may not.\n The new registrar has the name \u0027SunJCEWrapper\u0027 and can be\n configured like any other registrar. It can be disabled via\n the system property\n org.apache.sshd.security.provider.SunJCEWrapper.enabled=false.\n It is also disabled in FIPS mode (see above).\n The methods NamedFactory.setupBuiltinFactories(boolean\n ignoreUnsupported, ...) and\n NamedFactory.setupTransformedFactories(boolean\n ignoreUnsupported, ...) had a bug that gave the\n \u0027ignoreUnsupported\u0027 parameter actually the meaning of\n \u0027include unsupported\u0027.\n This was fixed in this release, but existing code calling\n these or one of the following methods:\n ~ BaseBuilder.setUpDefaultMacs(boolean ignoreUnsupported)\n ~ BaseBuilder.setUpDefaultCiphers(boolean ignoreUnsupported)\n ~ ClientBuilder.setUpDefaultCompressionFactories(boolean\n ignoreUnsupported)\n ~ ClientBuilder.setUpDefaultKeyExchanges(boolean\n ~ ClientBuilder.setUpDefaultSignatureFactories(boolean\n ~ ServerBuilder.setUpDefaultCompressionFactories(boolean\n ~ ServerBuilder.setUpDefaultKeyExchanges(boolean\n ~ ServerBuilder.setUpDefaultSignatureFactories(boolean\n ~ any of the methods starting with\n SshConfigFileReader.configure\n ~ SshClientConfigFileReader.configure(...)\n ~ SshServerConfigFileReader.configure(...)\n should be reviewed:\n ~ if the method is called with parameter value true, the\n result will no longer include unsupported algorithms.\n Formerly it wrongly did.\n ~ if the method is called with parameter value false, the\n result may include unsupported algorithms. Formerly it\n did not.\n So if existing code used parameter value false to ensure it\n never got unsupported algorithms, change it to true.\n * Major Code Re-factoring\n \u002B JDK requirements\n ~ GH-536 The project now requires JDK 17 at build time, while\n the target runtime still remains unchanged to support JDK\n 8.\n- Changes in version 2.13.2\n * What\u0027s Changed\n \u002B GH-525: Fix sntrup761x25519-sha512 by @tomaswolf in #528\n- Changes in version 2.13.1\n \u002B This release does not contain any code changes. It is solely\n to rectify the issue that the 2.13.0 release encountered\n during the release process, where the source jars were not\n created.\n- Changes in version 2.13.0\n \u002B GH-318: Handle cascaded proxy jumps by @tomaswolf in #512\n \u002B GH-427: Read initial ACK on channel open prior to direct\n stream upload \u0026 close streams prior to exit code handling by\n @TerraNibble in #464\n \u002B GH-455: ensure BaseCipher.update() fulfills the contract by\n @tomaswolf in #463\n \u002B GH-470: Synchronize not thread safe\n java.security.KeyPairGenerator.generateKe... by\n @zakharovsergey1000 in #467\n \u002B GH-476: Fix Android detection false negative by @wh0\n \u002B GH-475: Switch uses of JSch library to the\n com.github.mwiede:jsch fork by @Alex-Vol-Amz\n \u002B GH-472: change client start condition in sshd-spring-sftp by\n @alwaystom\n \u002B GH-489: sftp readdir: determine file type from longname by\n @tomaswolf in #491\n \u002B GH-486: Add missing U2F {ed25519,ecdsa}-sk public key\n equality methods by @lf-\n \u002B SSHD-1237 Handle keep-alive channel requests by @tomaswolf in\n #492\n \u002B GH-494: Nio2Session improvements by @evgeny-pasynkov\n \u002B GH-468: Handle excess data in SFTP read requests by\n @tomaswolf in #495\n \u002B GH-498: Implement the \u0027sntrup761x25519-sha512@openssh.com\u0027\n KEX method by @tomaswolf\n \u002B GH-500: SftpFileSystemProvider: close SftpClient on exception\n by @tomaswolf in #501\n \u002B GH-504: Pass reason to sessionNegotiationEnd by @duco-lw in\n #505\n \u002B GH-461: Fix heartbeats with wantReply=true by @tomaswolf in\n #507\n \u002B GH-493: Fix arcfour128 and arcfour256 ciphers (regression in\n 2.2.0)\n \u002B GH-509: SFTP v[456] client: validate attribute flags\n \u002B GH-510: Fix class name in BuiltinIoServiceFactoryFactories\n (regression in 2.6.0)\n \u002B sntrup761x25519-sha512@openssh.com Key Exchange\n The key exchange method sntrup761x25519-sha512@openssh.com is\n now available if the Bouncy Castle library is available.\n This uses a post-quantum key encapsulation method (KEM) to\n make key exchange future-proof against quantum attacks.\n More information can be found in IETF Memo Secure Shell (SSH)\n Key Exchange Method Using Hybrid Streamlined NTRU Prime\n sntrup761 and X25519 with SHA-512: sntrup761x25519-sha512.\n \u002B Behavioral changes and enhancements\n ~ GH-318 Handle cascaded proxy jumps\n Proxy jumps can be configured via host configuration\n entries in two ways. First, proxies can be chained directly\n by specifiying several proxies in one ProxyJump directive:\n Host target\n Hostname somewhere.example.org\n User some_user\n IdentityFile ~/.ssh/some_id\n ProxyJump jumphost2, jumphost1\n Host jumphost1\n Hostname jumphost1@example.org\n User jumphost1_user\n IdentityFile ~/.ssh/id_jumphost1\n Host jumphost2\n Hostname jumphost2@example.org\n User jumphost2_user\n IdentityFile ~/.ssh/id_jumphost2\n Connecting to server target will first connect to\n jumphost1, then tunnel through to jumphost2, and finally\n tunnel to target. So the full connection will be\n client-\u003Ejumphost1-\u003Ejumphost2-\u003Etarget.\n Such proxy jump chains were already supported in Apache\n MINA SSHD.\n Newly, Apache MINA SSHD also supports cascading proxy\n jumps, so a configuration like\n ProxyJump jumphost2\n ProxyJump jumphost1\n also works now, and produces the same connection\n It is possible to mis-configure such proxy jump cascades to\n have loops. (For instance, if host jumphost1 in the above\n example had a ProxyJump jumphost2 directive.) To catch such\n misconfigurations, Apache MINA SSHD imposes an upper limit\n on the total number of proxy jumps in a connection. An\n exception is thrown if there are more than\n CoreModuleProperties.MAX_PROXY_JUMPS proxy jumps in a\n connection. The default value of this property is 10. Most\n real uses of proxy jumps will have one or maybe two proxy\n jumps only.\n ~ GH-461 Fix heartbeats with wantReply=true\n The client-side heartbeat mechanism has been updated. Such\n heartbeats are configured via the\n CoreModuleProperties.HEARTBEAT_INTERVAL property. If this\n interval is \u003E 0, heartbeats are sent to the server.\n Previously these heartbeats could also be configured with a\n CoreModuleProperties.HEARTBEAT_REPLY_WAIT timeout. If the\n timeout was \u003C= 0, the client would just send heartbeat\n requests without expecting any answers. If the timeout was\n \u003E 0, the client would send requests with a flag indicating\n that the server should reply. The client would then wait\n for the specified duration for the reply and would\n terminate the connection if none was received.\n This mechanism could cause trouble if the timeout was\n fairly long and the server was slow to respond. A timeout\n longer than the interval could also delay subsequent\n heartbeats.\n The CoreModuleProperties.HEARTBEAT_REPLY_WAIT property is\n now deprecated.\n There is a new configuration property\n CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX instead. It\n defines a limit for the number of heartbeats sent without\n receiving a reply before a session is terminated. If the\n value is \u003C= 0, the client still sends heartbeats without\n expecting any reply. If the value is \u003E 0, the client will\n request a reply from the server for each heartbeat message,\n and it will terminate the connection if the number of\n unanswered heartbeats reaches\n CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX.\n This new way to configure heartbeats aligns with the\n OpenSSH configuration options ServerAliveInterval and\n ServerAliveCountMax.\n For compatibility with older configurations that explicitly\n define CoreModuleProperties.HEARTBEAT_REPLY_WAIT, the new\n code maps this to the new configuration (but only if\n CoreModuleProperties.HEARTBEAT_INTERVAL \u003E 0 and the new\n property CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX has\n not been set) by setting\n CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX to\n = CoreModuleProperties.HEARTBEAT_REPLY_WAIT \u003C= 0:\n CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX = 0\n = otherwise: (CoreModuleProperties.HEARTBEAT_REPLY_WAIT /\n CoreModuleProperties.HEARTBEAT_INTERVAL) \u002B 1.\n ~ GH-468 SFTP: validate length of data received: must not be\n more than requested\n SFTP read operations now check the amount of data they get\n back. If it\u0027s more than requested an exception is thrown.\n SFTP servers must never return more data than the client\n requested, but it appears that there are some that do so.\n If property SftpModuleProperties.TOLERATE_EXCESS_DATA is\n set to true, a warning is logged and such excess data is\n silently discarded.\n \u002B AES-CBC ciphers removed from server\u0027s defaults\n The AES-CBC ciphers aes128-cbc, aes192-cbc, and aes256-cbc\n have been removed from the default list of cipher algorithms\n that a server proposes in the key exchange. OpenSSH has\n removed these cipher algorithms from the server proposal in\n 2014, and has removed them from the client proposal in 2017.\n The cipher implementations still exist but they are not\n enabled by default. Existing code that explicitly sets the\n cipher factories is unaffected. Code that relies on the\n default settings will newly create a server that does not\n support the CBC-mode ciphers. To enable the CBC-mode ciphers,\n one can use for instance\n SshServer server = ServerBuilder.builder()\n ...\n .cipherFactories(BuiltinFactory.setUpFactories(false,\n BaseBuilder.DEFAULT_CIPHERS_PREFERENCES));\n .build();\n For the SSH client, the CBC ciphers are still enabled by\n default to facilitate connecting to legacy servers. We plan\n to remove the CBC ciphers from the client\u0027s defaults in the\n next release.\n- Changes in version 2.12.1\n \u002B GH-458 Singleton thread pool for kex message handler flushing\n \u002B SSHD-1338 Restore binary compatibility with 2.9.2\n \u002B Fix link by @swiedenfeld in #454\n \u002B SSHD-1338 Restore binary compatibility with 2.9.2 by @gnodet\n in #456\n \u002B Use a singleton threadpool for kex message handler flushing\n by @FliegenKLATSCH in #459\n- Enable module: sshd-openpgp\n- Add an \u0027extras\u0027 flavour to build without cycles all modules we\n can",
  "published": "2025-03-13T06:15:34Z",
  "severity": "medium",
  "cvss": 4.3,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
  "epss": 0.00143,
  "epssPercentile": 0.03646,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.6",
      "fixedVersion": "2.18.0-150200.5.11.1",
      "fix": "SUSE-SU-2026:2472-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2472-1",
      "released": "2026-06-19T13:41:43Z"
    },
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.7",
      "fixedVersion": "2.18.0-150200.5.11.1",
      "fix": "SUSE-SU-2026:2472-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2472-1",
      "released": "2026-06-19T13:41:43Z"
    },
    {
      "platform": "linux",
      "product": "ed25519-java",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.3.0-150200.5.9.1",
      "fix": "SUSE-SU-2025:1029-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1029-1",
      "released": "2025-03-26T13:11:18Z"
    },
    {
      "platform": "linux",
      "product": "ed25519-java",
      "release": "sles 15.6",
      "fixedVersion": "0.3.0-150200.5.9.1",
      "fix": "SUSE-SU-2025:1029-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1029-1",
      "released": "2025-03-26T13:11:18Z"
    },
    {
      "platform": "linux",
      "product": "jpgpj",
      "release": "sles 15.6",
      "fixedVersion": "1.3-150200.5.3.1",
      "fix": "SUSE-SU-2026:2472-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2472-1",
      "released": "2026-06-19T13:41:43Z"
    },
    {
      "platform": "linux",
      "product": "jpgpj",
      "release": "sles 15.7",
      "fixedVersion": "1.3-150200.5.3.1",
      "fix": "SUSE-SU-2026:2472-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2472-1",
      "released": "2026-06-19T13:41:43Z"
    },
    {
      "platform": "linux",
      "product": "libeddsa-java",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.3.0-2.1",
      "fix": "DEBIAN-CVE-2020-36843",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2020-36843",
      "released": "2025-03-13T06:15:34Z"
    },
    {
      "platform": "linux",
      "product": "libeddsa-java",
      "release": "Debian 14",
      "fixedVersion": "0.3.0-2.1",
      "fix": "DEBIAN-CVE-2020-36843",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2020-36843",
      "released": "2025-03-13T06:15:34Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}