CVE-2019-14855

Published: 20 March 2020

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Priority

Low

CVSS 3 base score: 7.5

Status

Notes

in master, gnupg disables SHA-1 signatures completely. In the
2.2 branch, it disables SHA-1 signatures after a certain date
only.

As of 2022-03-22 there is no upstream patch available
for gnupg 1.4 series. Backporting from 2.2 would be
too risky.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
• https://eprint.iacr.org/2020/014.pdf
• https://ubuntu.com/security/notices/USN-4516-1
• NVD
• Launchpad
• Debian

Bugs

• https://dev.gnupg.org/T4755