CVE-2019-14855

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-03-20 · updated 2026-06-17
Weakness: CWE-326

Description

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Affected products

Canonical Ubuntu Linux: 18.04
Fedoraproject Fedora: 30, 31
GnuPG: before 2.2.18 — fixed in 2.2.18

How to fix

Upgrade to a fixed version: GnuPG 2.2.18. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855
https://dev.gnupg.org/T4755
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
https://rwc.iacr.org/2020/slides/Leurent.pdf
https://usn.ubuntu.com/4516-1/
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855
https://dev.gnupg.org/T4755
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
https://rwc.iacr.org/2020/slides/Leurent.pdf
https://usn.ubuntu.com/4516-1/

Get alerted when CVE-2019-14855 or the next vulnerability affects your stack