Description
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | gnupg2 | 2.2.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnupg1 | No fix yet | — |
| Debian 14 | gnupg2 | 2.2.19-1 | — |
| Debian 13 | gnupg1 | No fix yet | — |
| Debian 13 | gnupg2 | 2.2.19-1 | — |
| Debian 12 | gnupg1 | No fix yet | — |
| Debian 12 | gnupg2 | 2.2.19-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gnupg1 | No fix yet | — |
| Ubuntu 26.04 LTS | gnupg1 | No fix yet | — |
| Ubuntu 25.10 | gnupg1 | No fix yet | — |
| Ubuntu 24.04 LTS | gnupg1 | No fix yet | — |
| Ubuntu 22.04 LTS | gnupg1 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | gnupg1 | No fix yet | — |
| Ubuntu 18.04 LTS | gnupg1 | No fix yet | — |
| Ubuntu 18.04 LTS | gnupg2 | 2.2.4-1ubuntu1.3 | USN-4516-1 |
| Ubuntu Pro 16.04 LTS | gnupg +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gnupg | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gpg2 | 2.2.27-2.4 | openSUSE-SU-2024:10815-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gnupg | 2.2.18-r0 | — |
| Alpine v3.23 | gnupg | 2.2.18-r0 | — |
| Alpine v3.22 | gnupg | 2.2.18-r0 | — |
| Alpine v3.21 | gnupg | 2.2.18-r0 | — |
| Alpine v3.20 | gnupg | 2.2.18-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | gnupg | 2.2.18-r0 | — |
| Alpine v3.18 | gnupg | 2.2.18-r0 | — |
| Alpine v3.17 | gnupg | 2.2.18-r0 | — |
| Alpine v3.16 | gnupg | 2.2.18-r0 | — |
| Alpine v3.15 | gnupg | 2.2.18-r0 | — |
| Alpine v3.14 | gnupg | 2.2.18-r0 | — |
| Alpine v3.13 | gnupg | 2.2.18-r0 | — |
| Alpine v3.12 | gnupg | 2.2.18-r0 | — |
| Alpine v3.11 | gnupg | 2.2.18-r0 | — |
| Alpine v3.10 | gnupg | 2.2.19-r0 | — |
| Alpine v3.9 | gnupg | 2.2.19-r0 | — |
| Alpine v3.8 | gnupg | 2.2.19-r0 | — |
Advisories 3
- USN-4516-1 gnupg2 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:10815-1 dirmngr-2.2.27-2.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-24-284-16 Rockwell Automation DataMosaix Private Cloud CISA ICS & IT advisories · Oct 10, 2024