Summary
It was discovered that GnuPG signatures could be forged when the SHA-1
algorithm is being used. This update removes validating signatures based on
SHA-1 that were generated after 2019-01-19. In environments where this is
still required, a new option --allow-weak-key-signatures can be used to
revert this behaviour.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | gnupg2 | 2.2.4-1ubuntu1.3 |
Vulnerabilities 1
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
References
-
report
https://ubuntu.com/security/CVE-2019-14855