CVE-2019-14855: Weak Encryption
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-14855?
CVE-2019-14855 is a vulnerability that allows an attacker to forge certificate signatures using collisions found in the SHA-1 algorithm.
What software versions are affected by CVE-2019-14855?
GnuPG versions before 2.2.18, gnupg1 before 1.4.23-1.1, gnupg2 before 2.2.12-1+deb10u2, gnupg2 before 2.2.4-1ubuntu1.3, gnupg2 before 2.2.19-1 are affected.
What is the severity of CVE-2019-14855?
CVE-2019-14855 has a severity rating of 7.5 (high).
How can an attacker exploit CVE-2019-14855?
An attacker can exploit CVE-2019-14855 to create forged certificate signatures.
Where can I find more information about CVE-2019-14855?
You can find more information about CVE-2019-14855 at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855), [link2](https://dev.gnupg.org/T4755), [link3](https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html).