CVE-2019-14855
Published: 20 March 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Notes
Author | Note |
---|---|
mdeslaur | in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only. |
rodrigo-zaiden | As of 2022-03-22 there is no upstream patch available for gnupg 1.4 series. Backporting from 2.2 would be too risky. |
Priority
Status
Package | Release | Status |
---|---|---|
gnupg Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
trusty |
Deferred
(2022-03-22)
|
|
upstream |
Needs triage
|
|
xenial |
Deferred
(2022-03-22)
|
|
gnupg1 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
disco |
Ignored
(reached end-of-life)
|
|
eoan |
Ignored
(reached end-of-life)
|
|
focal |
Needs triage
|
|
groovy |
Ignored
(reached end-of-life)
|
|
hirsute |
Ignored
(reached end-of-life)
|
|
impish |
Ignored
(reached end-of-life)
|
|
jammy |
Needs triage
|
|
kinetic |
Needs triage
|
|
lunar |
Needs triage
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
gnupg2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.4-1ubuntu1.3)
|
disco |
Ignored
(reached end-of-life)
|
|
eoan |
Ignored
(reached end-of-life)
|
|
focal |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
groovy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
hirsute |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
impish |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
jammy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
kinetic |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
lunar |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.2.19-1)
|
|
xenial |
Ignored
(change too intrusive)
|
|
Patches: upstream: https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4 (master) upstream: https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e (master) upstream: https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8 (master) upstream: https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1 (master) upstream: https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560 (2.2) upstream: https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76 (2.2) upstream: https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7 (2.2) upstream: https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a (2.2) |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |