CVE-2019-14855

Name of the Vulnerable Software and Affected Versions GnuPG versions prior to 2.2.18

Description A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. The issue is related to the use of weak encryption, which could allow a remote attacker to access confidential data.

Recommendations For GnuPG versions prior to 2.2.18, update to version 2.2.18 or later to resolve the issue. As a temporary workaround, consider restricting the use of certificate signatures until a patch is available. Avoid using the SHA-1 algorithm for certificate signatures in the affected versions.