1. Ubuntu Security Notices
  2. USN-4516-1

USN-4516-1: GnuPG vulnerability

Publication date

17 September 2020

Overview

GnuPG could be made to expose sensitive information.

Releases

Packages

  • gnupg2 - GNU privacy guard - a free PGP replacement

Details

It was discovered that GnuPG signatures could be forged when the SHA-1
algorithm is being used. This update removes validating signatures based on
SHA-1 that were generated after 2019-01-19. In environments where this is
still required, a new option --allow-weak-key-signatures can be used to
revert this behaviour.

It was discovered that GnuPG signatures could be forged when the SHA-1
algorithm is being used. This update removes validating signatures based on
SHA-1 that were generated after 2019-01-19. In environments where this is
still required, a new option --allow-weak-key-signatures can be used to
revert this behaviour.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
18.04 bionic gnupg –  2.2.4-1ubuntu1.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›