CVE-2019-14855 — gnupg2: OpenPGP Key Certification Forgeries with SHA-1

Back Back to CVE browser

HIGH

gnupg2: OpenPGP Key Certification Forgeries with SHA-1

Published Mar 20, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.08%

Description

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Affected products

Vendor Red Hat Product Gnupg2 Default
n/a
- Version
  2.2.18
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Gnupg2

n/a

Version	Status	Constraints
2.2.18	affected	-

Red Hat Enterprise Linux 5

gnupg

Out of support scope
Red Hat Enterprise Linux 5

gnupg2

Not affected
Red Hat Enterprise Linux 6

gnupg2

Not affected
Red Hat Enterprise Linux 7

gnupg2

Not affected
Red Hat Enterprise Linux 8

gnupg2

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	gnupg	Out of support scope	n/a
Red Hat Enterprise Linux 5	gnupg2	Not affected	n/a
Red Hat Enterprise Linux 6	gnupg2	Not affected	n/a
Red Hat Enterprise Linux 7	gnupg2	Not affected	n/a
Red Hat Enterprise Linux 8	gnupg2	Not affected	n/a

Remediation

Red Hat statement

This flaw only affects the versions of GnuPG package which defaults to signing with SHA-1. GnuPG 2.0 and above does not use SHA-1 by default therefore are not directly affected by this flaw.

Metrics

1.08% 0.01077

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01077

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.08% (0.01077)	63.83th	v5 (v2026.06.15)
Jun 15, 2026	1.05% (0.01050)	59.69th	v5 (v2026.06.15)
Mar 17, 2025	0.34% (0.00339)	54.43th	v4 (v2025.03.14)
Dec 12, 2024	0.23% (0.00230)	62.04th	v3 (v2023.03.01)
Jun 14, 2024	0.23% (0.00230)	61.31th	v3 (v2023.03.01)
Mar 7, 2023	0.23% (0.00230)	59.29th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	15.35% (0.15351)	91.59th	v2 (v2022.01.01)
Feb 3, 2022	5.36% (0.05363)	79.74th	v1
Jan 6, 2022	5.36% (0.05363)	79.54th	v1
Jan 5, 2022	1.25% (0.01247)	69.74th	v5 (v2026.06.15)
Apr 14, 2021	1.25% (0.01247)	0.00th	v1

Weaknesses (1)

CWE-326

Inadequate Encryption Strength

References (9)

https://access.redhat.com/security/cve/CVE-2019-14855
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1770900
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855
Issue TrackingThird Party Advisory
https://dev.gnupg.org/T4755
Vendor Advisory
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
Mailing ListRelease NotesVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14855
https://rwc.iacr.org/2020/slides/Leurent.pdf
ExploitThird Party Advisory
https://usn.ubuntu.com/4516-1/
vendor-advisoryThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-14855

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-14855		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1770900		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855		Issue TrackingThird Party Advisory
https://dev.gnupg.org/T4755		Vendor Advisory
https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html		Mailing ListRelease NotesVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14855
https://rwc.iacr.org/2020/slides/Leurent.pdf		ExploitThird Party Advisory
https://usn.ubuntu.com/4516-1/		vendor-advisoryThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-14855