CVE-2019-14855

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Inadequate Encryption Strength pada gnupg, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Rincian

Terbit di NVD

20 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dev.gnupg.org/T4755 advisory vendor
• https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html mailing list · release notes · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855 issue tracking · advisory pihak ketiga
• https://rwc.iacr.org/2020/slides/Leurent.pdf exploit · advisory pihak ketiga
• https://usn.ubuntu.com/4516-1/ advisory pihak ketiga