High Severity Vulnerability
This vulnerability has been rated as High severity. Immediate action is recommended.
CVE-2019-14855
High
Low
Medium
High
Critical
7.5
CVSS Score
Vulnerability Description
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
H
Integrity
N
Availability
N
Known Affected Software
3 configuration(s) from 2 vendor(s)
ubuntu_linux
Version:
18.04
CPE:
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
fedora
Version:
30
CPE:
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
fedora
Version:
31
CPE:
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
This vulnerability affects 3 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855secalert@redhat.com Issue Tracking Third Party Advisory
-
https://dev.gnupg.org/T4755secalert@redhat.com Vendor Advisory
-
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.htmlsecalert@redhat.com Mailing List Release Notes Vendor Advisory
-
https://rwc.iacr.org/2020/slides/Leurent.pdfsecalert@redhat.com Exploit Third Party Advisory
-
https://usn.ubuntu.com/4516-1/secalert@redhat.com Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855af854a3a-2127-422b-91ae-364da2661108 Issue Tracking Third Party Advisory
-
https://dev.gnupg.org/T4755af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory
-
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Release Notes Vendor Advisory
-
https://rwc.iacr.org/2020/slides/Leurent.pdfaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://usn.ubuntu.com/4516-1/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
Severity Details
7.5
out of 10.0
High
Weakness Type (CWE)
CWE-326
Inadequate Encryption Strength
- Description
- The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- Typical Severity
- Medium
- Abstraction Level
- Class
Key Information
- Published Date
- March 20, 2020
