CVE-2019-14855
Published: 20 March 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Priority
Low
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
gnupg Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 20.10 (Groovy Gorilla) |
Does not exist
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Does not exist
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Needed
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Needs triage
|
|
|
gnupg1 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 20.10 (Groovy Gorilla) |
Needs triage
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Needs triage
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needs triage
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
gnupg2 Launchpad, Ubuntu, Debian |
Upstream |
Released
(2.2.19-1)
|
| Ubuntu 20.10 (Groovy Gorilla) |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Not vulnerable
(2.2.19-3ubuntu2)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(2.2.4-1ubuntu1.3)
|
|
| Ubuntu 16.04 LTS (Xenial Xerus) |
Needed
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
Patches: Upstream: https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4 (master) Upstream: https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e (master) Upstream: https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8 (master) Upstream: https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1 (master) Upstream: https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560 (2.2) Upstream: https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76 (2.2) Upstream: https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7 (2.2) Upstream: https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a (2.2) |
||
Notes
| Author | Note |
|---|---|
| mdeslaur | in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
- https://eprint.iacr.org/2020/014.pdf
- https://usn.ubuntu.com/usn/usn-4516-1
- NVD
- Launchpad
- Debian