CVE-2019-14855
Published: 20 March 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Priority
CVSS 3 base score: 7.5
Status
Package | Release | Status |
---|---|---|
gnupg Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
precise |
Ignored
(end of ESM support, was needs-triage)
|
|
trusty |
Deferred
(2022-03-22)
|
|
upstream |
Needs triage
|
|
xenial |
Deferred
(2022-03-22)
|
|
gnupg1 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
disco |
Ignored
(reached end-of-life)
|
|
eoan |
Ignored
(reached end-of-life)
|
|
focal |
Needs triage
|
|
groovy |
Ignored
(reached end-of-life)
|
|
hirsute |
Ignored
(reached end-of-life)
|
|
impish |
Needs triage
|
|
jammy |
Needs triage
|
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
gnupg2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.4-1ubuntu1.3)
|
disco |
Ignored
(reached end-of-life)
|
|
eoan |
Ignored
(reached end-of-life)
|
|
focal |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
groovy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
hirsute |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
impish |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
jammy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.2.19-1)
|
|
xenial |
Needed
|
Notes
Author | Note |
---|---|
mdeslaur | in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only. |
rodrigo-zaiden | As of 2022-03-22 there is no upstream patch available for gnupg 1.4 series. Backporting from 2.2 would be too risky. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
- https://eprint.iacr.org/2020/014.pdf
- https://ubuntu.com/security/notices/USN-4516-1
- NVD
- Launchpad
- Debian