{"id":"CVE-2019-14855","aliases":["ALPINE-CVE-2019-14855","BELL-CVE-2019-14855","DEBIAN-CVE-2019-14855","EUVD-2019-5977","GHSA-cpvm-f36g-55vg","MGASA-2019-0348","UBUNTU-CVE-2019-14855","USN-4516-1","openSUSE-SU-2024:10815-1"],"status":"published","title":"A flaw was found in the way certificate signatures could be forged using collisions found in the...","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01077,"percentile":0.65254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-326"],"published":"2019-11-30T13:06:06Z","modified":"2026-10-17T12:55:39Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"gnupg","fixed_in":["2.2.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnupg","fixed_in":["2.2.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"gnupg","fixed_in":["2.2.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gnupg","fixed_in":["2.2.19-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnupg2","fixed_in":["2.2.19-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.2.19-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.2.19-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gnupg2","fixed_in":["2.2.18-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","fixed_in":["2.2.4-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-1.1","1.4.23-2","1.4.23-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3"]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.14-1ubuntu2","1.4.15-1.1ubuntu1","1.4.15-1.1ubuntu2","1.4.15-2ubuntu1","1.4.16-1ubuntu1","1.4.16-1ubuntu2","1.4.16-1ubuntu2.1","1.4.16-1ubuntu2.3","1.4.16-1ubuntu2.4","1.4.16-1ubuntu2.5","1.4.16-1ubuntu2.6","1.4.16-1ubuntu2.6+esm1","1.4.16-1ubuntu2.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.18-7ubuntu1","1.4.19-6ubuntu1","1.4.20-1ubuntu1","1.4.20-1ubuntu2","1.4.20-1ubuntu3","1.4.20-1ubuntu3.1","1.4.20-1ubuntu3.2","1.4.20-1ubuntu3.3","1.4.20-1ubuntu3.3+esm2","1.4.20-1ubuntu3.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2","2.1.11-6ubuntu2.1","2.1.11-6ubuntu2.1+esm1","2.1.11-6ubuntu2.1+esm2","2.1.11-6ubuntu2.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.3"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu1","1.4.22-3ubuntu1","1.4.22-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-1.1build2","1.4.23-1.1build4","1.4.23-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.23-3","1.4.23-3build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.3"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2.4"}]}],"bundled":8}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnupg","product":"gnupg"},{"vendor":"red hat","product":"gnupg2"}],"references":[{"url":"https://usn.ubuntu.com/4516-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://rwc.iacr.org/2020/slides/Leurent.pdf","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html","tags":["x_transferred","Mailing List","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://dev.gnupg.org/T4755","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14855"},{"url":"https://github.com/advisories/GHSA-cpvm-f36g-55vg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14855","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-14855","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14855","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14855","tags":["report"]},{"url":"https://eprint.iacr.org/2020/014.pdf","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4516-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14855","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25125","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T00:00:00Z","modified":"2024-08-05T00:26:39.14Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5977","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T00:00:00Z","modified":"2024-08-05T00:26:39Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-cpvm-f36g-55vg","title":"A flaw was found in the way certificate signatures could be forged using collisions found in the...","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2022-05-24T17:12:00Z","modified":"2023-01-28T05:08:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:44:36.474417Z"}],"nvd":[{"id":"CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T16:15:14.68Z","modified":"2026-06-17T02:19:10.563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:05:45.254119Z"}],"osv":[{"id":"ALPINE-CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T16:15:14.68Z","modified":"2026-09-21T06:17:52.487763525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-14855","title":"CVE-2019-14855 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:28.330241Z","modified":"2026-01-26T09:48:03.184294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T16:15:14.68Z","modified":"2026-04-16T04:30:36.575415288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T16:15:14.68Z","modified":"2026-09-21T07:02:08.252225301Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-14855","description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.","status":"published","published":"2020-03-20T16:15:00Z","modified":"2026-10-17T12:55:39.095355956Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"MGASA-2019-0348","title":"Updated gnupg2 packages fix security vulnerability","description":"gnupg2 is updated to 2.2.18 and fix security vulnerability:\n\nWeb of Trust forgeries using collisions in SHA-1 signatures (CVE-2019-14855)\n* Note that this change removes all SHA-1 based key signature  newer than\n  2019-01-19 from the web-of-trust. This includes all key signature created\n  with dsa1024 keys. The new option --allow-weak-key-signatues can be used\n  to override the new and safer behaviour.\n\nFor other fixes in this update, see the gnupg-announce reference.\n","status":"published","published":"2019-11-30T13:06:06Z","modified":"2026-04-16T04:43:21.445622448Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10815-1","title":"dirmngr-2.2.27-2.4 on GA media","description":"These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:05.784342Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4516-1","title":"gnupg2 vulnerability","description":"It was discovered that GnuPG signatures could be forged when the SHA-1\nalgorithm is being used. This update removes validating signatures based on\nSHA-1 that were generated after 2019-01-19. In environments where this is\nstill required, a new option --allow-weak-key-signatures can be used to\nrevert this behaviour.\n","status":"published","published":"2020-09-17T17:41:13Z","modified":"2026-04-27T15:42:13.395172Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}