CVE-2019-14855: Weak Encryption

Reference Links

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855
• https://dev.gnupg.org/T4755
• https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
• https://rwc.iacr.org/2020/slides/Leurent.pdf
• https://usn.ubuntu.com/4516-1/
• https://launchpad.net/bugs/cve/CVE-2019-14855
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=7d9aad63c4f1aefe97da61baf5acd96c12c0278e
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=dd18be979e138dd3712315ee390463e8ee1fe8c1
• https://eprint.iacr.org/2020/014.pdf
• https://security-tracker.debian.org/tracker/CVE-2019-14855
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
• https://ubuntu.com/security/notices/USN-4516-1
• https://nvd.nist.gov/vuln/detail/CVE-2019-14855
• https://github.com/gpg/gnupg/commit/c4f2d9e3e1d77d2f1f168764fcdfed32f7d1dfc4 (master)
• https://github.com/gpg/gnupg/commit/7d9aad63c4f1aefe97da61baf5acd96c12c0278e (master)
• https://github.com/gpg/gnupg/commit/e624c41dbafd33af82c1153188d14de72fcc7cd8 (master)
• https://github.com/gpg/gnupg/commit/dd18be979e138dd3712315ee390463e8ee1fe8c1 (master)
• https://github.com/gpg/gnupg/commit/edc36f59fcfcb4b896a53530345d586f7e5df560 (2.2)
• https://github.com/gpg/gnupg/commit/3b1fcf65239d9c73cc54760ea52a5749e024fa76 (2.2)
• https://github.com/gpg/gnupg/commit/754a03f5a279964af62025d11d92391e650fddb7 (2.2)
• https://github.com/gpg/gnupg/commit/8e49fc7f43ecfe44dac57d97c555e2cbc7eb8e9a (2.2)
• https://ubuntu.com/security/CVE-2019-14855

Parent vulnerabilities

(Appears in the following advisories)

• USN-4516-1

Frequently Asked Questions

• What is CVE-2019-14855?

  CVE-2019-14855 is a vulnerability that allows an attacker to forge certificate signatures using collisions found in the SHA-1 algorithm.

• What software versions are affected by CVE-2019-14855?

  GnuPG versions before 2.2.18, gnupg1 before 1.4.23-1.1, gnupg2 before 2.2.12-1+deb10u2, gnupg2 before 2.2.4-1ubuntu1.3, gnupg2 before 2.2.19-1 are affected.

• What is the severity of CVE-2019-14855?

  CVE-2019-14855 has a severity rating of 7.5 (high).

• How can an attacker exploit CVE-2019-14855?

  An attacker can exploit CVE-2019-14855 to create forged certificate signatures.

• Where can I find more information about CVE-2019-14855?

  You can find more information about CVE-2019-14855 at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855), [link2](https://dev.gnupg.org/T4755), [link3](https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html).