CVE-2019-14855

Published: 20 March 2020

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
gnupg Launchpad, Ubuntu, Debian	Upstream	Needs triage

	Ubuntu 20.10 (Groovy Gorilla)	Does not exist
	Ubuntu 20.04 LTS (Focal Fossa)	Does not exist
	Ubuntu 18.04 LTS (Bionic Beaver)	Does not exist
	Ubuntu 16.04 LTS (Xenial Xerus)	Needed
	Ubuntu 14.04 ESM (Trusty Tahr)	Needs triage
	Ubuntu 12.04 ESM (Precise Pangolin)	Needs triage
gnupg1 Launchpad, Ubuntu, Debian	Upstream	Needs triage

	Ubuntu 20.10 (Groovy Gorilla)	Needs triage
	Ubuntu 20.04 LTS (Focal Fossa)	Needs triage
	Ubuntu 18.04 LTS (Bionic Beaver)	Needs triage
	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Ubuntu 12.04 ESM (Precise Pangolin)	Does not exist
gnupg2 Launchpad, Ubuntu, Debian	Upstream	Released (2.2.19-1)

	Ubuntu 20.10 (Groovy Gorilla)	Not vulnerable (2.2.19-3ubuntu2)
	Ubuntu 20.04 LTS (Focal Fossa)	Not vulnerable (2.2.19-3ubuntu2)
	Ubuntu 18.04 LTS (Bionic Beaver)	Released (2.2.4-1ubuntu1.3)
	Ubuntu 16.04 LTS (Xenial Xerus)	Needed
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Ubuntu 12.04 ESM (Precise Pangolin)	Does not exist
	Patches: Upstream: https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4 (master) Upstream: https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e (master) Upstream: https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8 (master) Upstream: https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1 (master) Upstream: https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560 (2.2) Upstream: https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76 (2.2) Upstream: https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7 (2.2) Upstream: https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a (2.2)

Notes

Author	Note
mdeslaur	in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only.

References

Bugs

https://dev.gnupg.org/T4755

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM