# CVE-2020-36843: apache-sshd: This update for apache-sshd, jpgpj fixes the following issues  - CVE-2020-36843: no check performed on scalar to avoi...

CVE-2020-36843 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2020-36843, released March 13, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2020-36843
- Priority: Routine
- CVSS: 4.3 (medium)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 13, 2025

## Description

This update for apache-sshd, jpgpj fixes the following issues  - CVE-2020-36843: no check performed on scalar to avoid signature malleability (bsc#1239551). - CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd: sshd-git (bsc#1267018).  Changes for jpgpj:  - Initial packaging with v1.3  Changes for apache-sshd:  - Update to upstream version 2.18.0  * Bug Fixes  + GH-743 Ensure the Java ServiceLoader use a singleton  SftpFileSystemProvider  + GH-879 Close SSH channel gracefully on exception in port  forwarding  + Security: Improve handling of repository paths in sshd-git.  Resolves CVE-2026-48827, bsc#1267018  * New Features  + GH-892 Align handling certificates without principals with  OpenSSH 10.3 - Update to upstream version 2.17.1  * Changes  + GH-875 Use Apache Parent POM 36 - Update to upstream version 2.17.0  + GH-469, SSHD-897 Fix duplicate character echo with interactive  shells  + GH-721 SSH client: schedule session timeout checks on demand  only  + GH-807 Handle 'verified' flag for sk-* keys  + GH-809 Fix server-side authentication for FIDO/U2F sk-* keys  with flags in authorized_keys  + GH-827 Don't fail on invalid known_hosts lines; log and skip  them  + GH-830 EC public keys: let Bouncy Castle generate X.509  encodings with the curve OID as algorithm parameter  + GH-855 SFTP: use a single SftpClient per SftpFileSystem  + GH-856 Fix using ed25519 with BC-FIPS  + GH-861 SFTP client: prevent sending zero-length writes in  SftpOutputStreamAsync  + SSHD-1348 Fix zero-length SFTP reads  + SSHD-1349 Bump PMD to 7.20.0 to avoid StackOverflowError when  compiling on Java 26-ea  + GH-814 Include a fix for CVE-2020-36843 (bsc#1239551) in  optional dependency net.i2p.crypto:eddsa:0.3.0: perform the  missing range check in Apache MINA SSHD before delegating to  the signature verification in net.i2p.crypto:eddsa:0.3.0.  This means that using net.i2p.crypto:eddsa:0.3.0 in Apache  MINA SSHD is safe despite that CVE in the dependency.  + GH-865 replace %h in HostName SSH config - Update to upstream version 2.16.0  * Changes of version 2.16.0  + bugfix: fix cert auth failed bug  + GH-664: Skip MAC negotiation if an AEAD cipher was negotiated  + GH-663: Fix a race in IoSession creation  + Also test sshd-mina using mina-core 2.2.4  + ScpShell fixes; SFTP append mode for buggy servers  + fix sources.jar Reproducible Builds issue  + GH-700: Fix race in AbstractCloseable.doCloseImmediately()  + GH-705: Make ChannelToPortHandler accessible to user code  + GH-709: Handle keep-alive channel messages sent by an old  OpenSSH server  + GH-727: supply default port for proxyJump if no  HostConfigEntry  + GH-733: Fix SftpRemotePathChannel.transferTo  + GH-725: Added commandTimeoutMillis in executeRemoteCommand  + GH-774: Fix WritePendingException  + #771 Avoid NoClassDefFoundError:  net/i2p/crypto/eddsa/EdDSAPublicKey  + GH-516: Fix filesystem-id parsing in getFileSystem(URI)  + GH-754: Don't close DefaultForwarder on bind error  + Close repository after usage in GitPackCommand  + Trigger ClientChannelEvent.Timeout and  ClientSessionEvent.TIMEOUT independently to host's program  cycle times  * Changes of version 2.15.0  + GH-618: Fix reading an OpenSshCertificate from a Buffer  + Add interface to configure details of JGit's pack  implementation  + ML-KEM key exchanges using Bouncy Castle 1.79  + GH-628: Fix reading directories with trailing blanks in the  name  + GH-626: Enable Streaming.Async for ChannelDirectTcpip  + Sftp server 'ls' command timeout  + GH-636: Handle unknown key types in known_hosts  + GH-643: provide interfaces for caching file attributes on  paths  + Bouncy Castle EdDSA / Ed25519 Support  + Abstract revoked key handling in KnownHostsServerKeyVerifier - Fix an incompletely interpolated dependency with maven 4.0.0-rc-4 - Fix wrong invocation of xmvn-subst - Updated to upstream version 2.14.0 - Changes in version 2.14.0  + GH-524 Performance improvements  + GH-533 Fix multi-step authentication  + GH-582 Fix filtering in NamedFactory  + GH-587 Prevent NullPointerExceptionon closed channel in  NettyIoSession  + GH-590 Better support for FIPS  + GH-597 Pass on Charset in  ClientSession.executeRemoteCommand()  + New utility methods SftpClient.put(Path localFile, String  remoteFileName) and SftpClient.put(InputStream in, String  remoteFileName) facilitate SFTP file uploading.  * GH-590 Better support for FIPS  Besides fixing a bug with bc-fips (the RandomGenerator class  exists in normal Bouncy Castle, but not in the FIPS version,  but Apache MINA sshd referenced it even if only bc-fips was  present), support was improved for running in an environment  restricted by FIPS.  There is a new system property  org.apache.sshd.security.fipsEnabled. If set to true, a number  of crypto-algorithms not approved by FIPS 140 are disabled:  + key exchange methods sntrup761x25519-sha512,  sntrup761x25519-sha512@openssh.com, curve25519-sha256,  curve25519-sha256@libssh.org, curve448-sha512.  + the chacha20-poly1305 cipher.  + the bcrypt KDF used in encrypted private key files in  OpenSSH format.  + all ed25519 keys and signatures.  Additionally, the new 'SunJCEWrapper' SecurityProviderRegistrar  (see below) and the EdDSASecurityProviderRegistrar are  disabled, and the BouncyCastleScurityProviderRegistrar looks  only for the 'BCFIPS' security provider, not for the normal  'BC' provider.  If the system property is not set to true, FIPS mode can be  enabled programmatically by calling SecurityUtils.setFipsMode()  before any other call to Apache MINA sshd.  * Potential compatibility issues  + New security provider registrar  There is a new SecurityProviderRegistrar that is registered  by default if there is a SunJCE security provider. It uses  the AES and HmacSHA* implementations from SunJCE even if  Bouncy Castle is also registered. SunJCE has native  implementations, whereas Bouncy Castle may not.  The new registrar has the name 'SunJCEWrapper' and can be  configured like any other registrar. It can be disabled via  the system property  org.apache.sshd.security.provider.SunJCEWrapper.enabled=false.  It is also disabled in FIPS mode (see above).  The methods NamedFactory.setupBuiltinFactories(boolean  ignoreUnsupported, ...) and  NamedFactory.setupTransformedFactories(boolean  ignoreUnsupported, ...) had a bug that gave the  'ignoreUnsupported' parameter actually the meaning of  'include unsupported'.  This was fixed in this release, but existing code calling  these or one of the following methods:  ~ BaseBuilder.setUpDefaultMacs(boolean ignoreUnsupported)  ~ BaseBuilder.setUpDefaultCiphers(boolean ignoreUnsupported)  ~ ClientBuilder.setUpDefaultCompressionFactories(boolean  ignoreUnsupported)  ~ ClientBuilder.setUpDefaultKeyExchanges(boolean  ~ ClientBuilder.setUpDefaultSignatureFactories(boolean  ~ ServerBuilder.setUpDefaultCompressionFactories(boolean  ~ ServerBuilder.setUpDefaultKeyExchanges(boolean  ~ ServerBuilder.setUpDefaultSignatureFactories(boolean  ~ any of the methods starting with  SshConfigFileReader.configure  ~ SshClientConfigFileReader.configure(...)  ~ SshServerConfigFileReader.configure(...)  should be reviewed:  ~ if the method is called with parameter value true, the  result will no longer include unsupported algorithms.  Formerly it wrongly did.  ~ if the method is called with parameter value false, the  result may include unsupported algorithms. Formerly it  did not.  So if existing code used parameter value false to ensure it  never got unsupported algorithms, change it to true.  * Major Code Re-factoring  + JDK requirements  ~ GH-536 The project now requires JDK 17 at build time, while  the target runtime still remains unchanged to support JDK  8. - Changes in version 2.13.2  * What's Changed  + GH-525: Fix sntrup761x25519-sha512 by @tomaswolf in #528 - Changes in version 2.13.1  + This release does not contain any code changes. It is solely  to rectify the issue that the 2.13.0 release encountered  during the release process, where the source jars were not  created. - Changes in version 2.13.0  + GH-318: Handle cascaded proxy jumps by @tomaswolf in #512  + GH-427: Read initial ACK on channel open prior to direct  stream upload & close streams prior to exit code handling by  @TerraNibble in #464  + GH-455: ensure BaseCipher.update() fulfills the contract by  @tomaswolf in #463  + GH-470: Synchronize not thread safe  java.security.KeyPairGenerator.generateKe... by  @zakharovsergey1000 in #467  + GH-476: Fix Android detection false negative by @wh0  + GH-475: Switch uses of JSch library to the  com.github.mwiede:jsch fork by @Alex-Vol-Amz  + GH-472: change client start condition in sshd-spring-sftp by  @alwaystom  + GH-489: sftp readdir: determine file type from longname by  @tomaswolf in #491  + GH-486: Add missing U2F {ed25519,ecdsa}-sk public key  equality methods by @lf-  + SSHD-1237 Handle keep-alive channel requests by @tomaswolf in  #492  + GH-494: Nio2Session improvements by @evgeny-pasynkov  + GH-468: Handle excess data in SFTP read requests by  @tomaswolf in #495  + GH-498: Implement the 'sntrup761x25519-sha512@openssh.com'  KEX method by @tomaswolf  + GH-500: SftpFileSystemProvider: close SftpClient on exception  by @tomaswolf in #501  + GH-504: Pass reason to sessionNegotiationEnd by @duco-lw in  #505  + GH-461: Fix heartbeats with wantReply=true by @tomaswolf in  #507  + GH-493: Fix arcfour128 and arcfour256 ciphers (regression in  2.2.0)  + GH-509: SFTP v[456] client: validate attribute flags  + GH-510: Fix class name in BuiltinIoServiceFactoryFactories  (regression in 2.6.0)  + sntrup761x25519-sha512@openssh.com Key Exchange  The key exchange method sntrup761x25519-sha512@openssh.com is  now available if the Bouncy Castle library is available.  This uses a post-quantum key encapsulation method (KEM) to  make key exchange future-proof against quantum attacks.  More information can be found in IETF Memo Secure Shell (SSH)  Key Exchange Method Using Hybrid Streamlined NTRU Prime  sntrup761 and X25519 with SHA-512: sntrup761x25519-sha512.  + Behavioral changes and enhancements  ~ GH-318 Handle cascaded proxy jumps  Proxy jumps can be configured via host configuration  entries in two ways. First, proxies can be chained directly  by specifiying several proxies in one ProxyJump directive:  Host target  Hostname somewhere.example.org  User some_user  IdentityFile ~/.ssh/some_id  ProxyJump jumphost2, jumphost1  Host jumphost1  Hostname jumphost1@example.org  User jumphost1_user  IdentityFile ~/.ssh/id_jumphost1  Host jumphost2  Hostname jumphost2@example.org  User jumphost2_user  IdentityFile ~/.ssh/id_jumphost2  Connecting to server target will first connect to  jumphost1, then tunnel through to jumphost2, and finally  tunnel to target. So the full connection will be  client->jumphost1->jumphost2->target.  Such proxy jump chains were already supported in Apache  MINA SSHD.  Newly, Apache MINA SSHD also supports cascading proxy  jumps, so a configuration like  ProxyJump jumphost2  ProxyJump jumphost1  also works now, and produces the same connection  It is possible to mis-configure such proxy jump cascades to  have loops. (For instance, if host jumphost1 in the above  example had a ProxyJump jumphost2 directive.) To catch such  misconfigurations, Apache MINA SSHD imposes an upper limit  on the total number of proxy jumps in a connection. An  exception is thrown if there are more than  CoreModuleProperties.MAX_PROXY_JUMPS proxy jumps in a  connection. The default value of this property is 10. Most  real uses of proxy jumps will have one or maybe two proxy  jumps only.  ~ GH-461 Fix heartbeats with wantReply=true  The client-side heartbeat mechanism has been updated. Such  heartbeats are configured via the  CoreModuleProperties.HEARTBEAT_INTERVAL property. If this  interval is > 0, heartbeats are sent to the server.  Previously these heartbeats could also be configured with a  CoreModuleProperties.HEARTBEAT_REPLY_WAIT timeout. If the  timeout was <= 0, the client would just send heartbeat  requests without expecting any answers. If the timeout was  > 0, the client would send requests with a flag indicating  that the server should reply. The client would then wait  for the specified duration for the reply and would  terminate the connection if none was received.  This mechanism could cause trouble if the timeout was  fairly long and the server was slow to respond. A timeout  longer than the interval could also delay subsequent  heartbeats.  The CoreModuleProperties.HEARTBEAT_REPLY_WAIT property is  now deprecated.  There is a new configuration property  CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX instead. It  defines a limit for the number of heartbeats sent without  receiving a reply before a session is terminated. If the  value is <= 0, the client still sends heartbeats without  expecting any reply. If the value is > 0, the client will  request a reply from the server for each heartbeat message,  and it will terminate the connection if the number of  unanswered heartbeats reaches  CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX.  This new way to configure heartbeats aligns with the  OpenSSH configuration options ServerAliveInterval and  ServerAliveCountMax.  For compatibility with older configurations that explicitly  define CoreModuleProperties.HEARTBEAT_REPLY_WAIT, the new  code maps this to the new configuration (but only if  CoreModuleProperties.HEARTBEAT_INTERVAL > 0 and the new  property CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX has  not been set) by setting  CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX to  = CoreModuleProperties.HEARTBEAT_REPLY_WAIT <= 0:  CoreModuleProperties.HEARTBEAT_NO_REPLY_MAX = 0  = otherwise: (CoreModuleProperties.HEARTBEAT_REPLY_WAIT /  CoreModuleProperties.HEARTBEAT_INTERVAL) + 1.  ~ GH-468 SFTP: validate length of data received: must not be  more than requested  SFTP read operations now check the amount of data they get  back. If it's more than requested an exception is thrown.  SFTP servers must never return more data than the client  requested, but it appears that there are some that do so.  If property SftpModuleProperties.TOLERATE_EXCESS_DATA is  set to true, a warning is logged and such excess data is  silently discarded.  + AES-CBC ciphers removed from server's defaults  The AES-CBC ciphers aes128-cbc, aes192-cbc, and aes256-cbc  have been removed from the default list of cipher algorithms  that a server proposes in the key exchange. OpenSSH has  removed these cipher algorithms from the server proposal in  2014, and has removed them from the client proposal in 2017.  The cipher implementations still exist but they are not  enabled by default. Existing code that explicitly sets the  cipher factories is unaffected. Code that relies on the  default settings will newly create a server that does not  support the CBC-mode ciphers. To enable the CBC-mode ciphers,  one can use for instance  SshServer server = ServerBuilder.builder()  ...  .cipherFactories(BuiltinFactory.setUpFactories(false,  BaseBuilder.DEFAULT_CIPHERS_PREFERENCES));  .build();  For the SSH client, the CBC ciphers are still enabled by  default to facilitate connecting to legacy servers. We plan  to remove the CBC ciphers from the client's defaults in the  next release. - Changes in version 2.12.1  + GH-458 Singleton thread pool for kex message handler flushing  + SSHD-1338 Restore binary compatibility with 2.9.2  + Fix link by @swiedenfeld in #454  + SSHD-1338 Restore binary compatibility with 2.9.2 by @gnodet  in #456  + Use a singleton threadpool for kex message handler flushing  by @FliegenKLATSCH in #459 - Enable module: sshd-openpgp - Add an 'extras' flavour to build without cycles all modules we  can

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apache-sshd sles 15.6 | 2.18.0-150200.5.11.1 | [SUSE-SU-2026:2472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2472-1.md) | Jun 19, 2026 |
| Linux | apache-sshd sles 15.7 | 2.18.0-150200.5.11.1 | [SUSE-SU-2026:2472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2472-1.md) | Jun 19, 2026 |
| Linux | ed25519-java opensuse-leap 15.6 | 0.3.0-150200.5.9.1 | [SUSE-SU-2025:1029-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1029-1.md) | Mar 26, 2025 |
| Linux | ed25519-java sles 15.6 | 0.3.0-150200.5.9.1 | [SUSE-SU-2025:1029-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1029-1.md) | Mar 26, 2025 |
| Linux | jpgpj sles 15.6 | 1.3-150200.5.3.1 | [SUSE-SU-2026:2472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2472-1.md) | Jun 19, 2026 |
| Linux | jpgpj sles 15.7 | 1.3-150200.5.3.1 | [SUSE-SU-2026:2472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2472-1.md) | Jun 19, 2026 |
| Linux | libeddsa-java Debian 13.5 (trixie) | 0.3.0-2.1 | [DEBIAN-CVE-2020-36843](https://patchblox.com/security/data/fix/linux/debian-cve-2020-36843.md) | Mar 13, 2025 |
| Linux | libeddsa-java Debian 14 | 0.3.0-2.1 | [DEBIAN-CVE-2020-36843](https://patchblox.com/security/data/fix/linux/debian-cve-2020-36843.md) | Mar 13, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.