--- title: "CVE-2019-14855\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2019-14855?format=md keywords: index, follow --- # CVE-2019-14855 Publication date 20 March 2020 Last updated 11 July 2025 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **5.3 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2019-14855?format=md#impact-score) Toggle side navigation ## Description A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. [Read the notes from the security team](https://ubuntu.com/security/CVE-2019-14855?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | gnupg1 | 26.04 LTS resolute | Needs evaluation | | 25.10 questing | Ignored end of life, was needs-triage | | 25.04 plucky | Ignored end of life, was needs-triage | | 24.10 oracular | Ignored end of life, was needs-triage | | 24.04 LTS noble | Needs evaluation | | 23.10 mantic | Ignored end of life, was needs-triage | | 23.04 lunar | Ignored end of life, was needs-triage | | 22.10 kinetic | Ignored end of life, was needs-triage | | 22.04 LTS jammy | Needs evaluation | | 21.10 impish | Ignored end of life | | 21.04 hirsute | Ignored end of life | | 20.10 groovy | Ignored end of life | | 20.04 LTS focal | Needs evaluation | | 19.10 eoan | Ignored end of life | | 19.04 disco | Ignored end of life | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | gnupg | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Vulnerable, fix deferred | | 14.04 LTS trusty | Vulnerable, fix deferred | | gnupg2 | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Ignored end of life | | 19.04 disco | Ignored end of life | | 18.04 LTS bionic | Fixed 2.2.4-1ubuntu1.3 | | 16.04 LTS xenial | Ignored end of standard support, was needed | | 14.04 LTS trusty | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2019-14855?format=md#patch-details) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) in master, gnupg disables SHA-1 signatures completely. In the 2.2 branch, it disables SHA-1 signatures after a certain date only. --- ### [rodrigo-zaiden](https://launchpad.net/~rodrigo-zaiden) As of 2022-03-22 there is no upstream patch available for gnupg 1.4 series. Backporting from 2.2 would be too risky. ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | gnupg2 | * Upstream: [c4f2d9e](https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4) * Upstream: [7d9aad6](https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e) * Upstream: [e624c41](https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8) * Upstream: [dd18be9](https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1) * Upstream: [edc36f5](https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560) * Upstream: [3b1fcf6](https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76) * Upstream: [754a03f](https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7) * Upstream: [8e49fc7](https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 5.3 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | High | | Privileges required | None | | User interaction | Required | | Scope | Unchanged | | Confidentiality impact | High | | Integrity impact | None | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 5.3 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-14855) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2019-14855) * [Debian](https://security-tracker.debian.org/tracker/CVE-2019-14855) ### Related Ubuntu Security Notices (USN) + [USN-4516-1](https://usn.ubuntu.com/USN-4516-1) + GnuPG vulnerability + 17 September 2020 ### Other references * *