Logo
›
›vulnerability›CVE-2019-14855
Name
CVE-2019-14855
Source
NVD ( link)Debian ( link)
Description
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
CWEs
CWE-326 CWE-326
Published Date
Updated Date
Workaround
-
Advisories
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855Issue Tracking
https://dev.gnupg.org/T4755Vendor Advisory
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.htmlMailing List
https://rwc.iacr.org/2020/slides/Leurent.pdfExploit
https://usn.ubuntu.com/4516-1/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855Issue Tracking
https://dev.gnupg.org/T4755Vendor Advisory
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.htmlMailing List
https://rwc.iacr.org/2020/slides/Leurent.pdfExploit
https://usn.ubuntu.com/4516-1/Third Party Advisory

Analysis#

Affected Component
Analysis
gnupg
Exploitable

Vulnerability Ratings#

7.5
CVSSv31
5.3
other
5
CVSSv2

Others affected components#

Name
Project
Project Version
Version
Status
gnupg
buildroot
master
1.4.23
Exploitable
gnupg2
buildroot
master
2.5.20
Not Affected
gnupg
openwrt
master
1.4.23-r5
Exploitable
gnupg2
openwrt
master
2.5.20-r1
Not Affected
gnupg
openwrt
openwrt-25.12
1.4.23-r5
Exploitable
gnupg2
openwrt
openwrt-25.12
2.4.8-r1
Not Affected
gnupg
yocto
kirkstone
2.3.7
Not Affected
gnupg
yocto
master
2.5.17
Not Affected
gnupg
yocto
scarthgap
2.4.9
Not Affected