CVE-2019-14855
Published: 20 March 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Notes
| Author | Note |
|---|---|
| mdeslaur | in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only. |
| rodrigo-zaiden | As of 2022-03-22 there is no upstream patch available for gnupg 1.4 series. Backporting from 2.2 would be too risky. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
gnupg Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Deferred
(2022-03-22)
|
|
| upstream |
Needs triage
|
|
| xenial |
Deferred
(2022-03-22)
|
|
|
gnupg1 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| disco |
Ignored
(reached end-of-life)
|
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Needs triage
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Ignored
(reached end-of-life)
|
|
| jammy |
Needs triage
|
|
| kinetic |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
gnupg2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.4-1ubuntu1.3)
|
| disco |
Ignored
(reached end-of-life)
|
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| groovy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| hirsute |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| impish |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| jammy |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| kinetic |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| lunar |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(2.2.19-1)
|
|
| xenial |
Ignored
(change too intrusive)
|
|
|
Patches: upstream: https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4 (master) upstream: https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e (master) upstream: https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8 (master) upstream: https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1 (master) upstream: https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560 (2.2) upstream: https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76 (2.2) upstream: https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7 (2.2) upstream: https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a (2.2) |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |