CVE-2019-14855

HIGH

GnuPG < 2.2.18 - Certificate Signature Forgery via SHA-1 Collision

Title source: llm

Description

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

References (5)

Core 5

Core References

Third Party Advisory vendor-advisory

https://usn.ubuntu.com/4516-1/

Issue Tracking, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855

Vendor Advisory

https://dev.gnupg.org/T4755

Mailing List, Release Notes, Vendor Advisory

https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html

Exploit, Third Party Advisory

https://rwc.iacr.org/2020/slides/Leurent.pdf

Scores

CVSS v3 7.5

EPSS 0.0034

EPSS Percentile 56.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-326

Status published

Products (4)

canonical/ubuntu_linux 18.04

fedoraproject/fedora 30

fedoraproject/fedora 31

gnupg/gnupg < 2.2.18

Published Mar 20, 2020

Tracked Since Feb 18, 2026