{"id":"CVE-2005-4900","published":"2016-10-14T16:00:00Z","modified":"2026-05-22T16:18:17Z","title":"SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks…","vendor":null,"product":null,"tier":"tail","description":{"text":"SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2.  NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0093,"percentile":0.60482,"provenance":"source"},"cwes":[{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm"}],"references":[{"url":"https://sites.google.com/site/itstheshappening","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/12577","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://shattered.io/","tags":["x_refsource_MISC"]},{"url":"https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html","tags":["x_refsource_MISC"]},{"url":"http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1","tags":["x_refsource_MISC"]},{"url":"http://ia.cr/2007/474","tags":["x_refsource_MISC"]},{"url":"https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html","tags":["x_refsource_MISC"]},{"url":"https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html","tags":["x_refsource_MISC"]},{"url":"https://www.schneier.com/blog/archives/2005/02/sha1_broken.html","tags":["x_refsource_MISC"]},{"url":"https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/","tags":["x_refsource_MISC"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10340","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.2,"factors":[{"name":"EPSS percentile","points":12.1},{"name":"CVSS severity","points":4.13}]},"euvd":{"id":"EUVD-2005-4891","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sylabs-sif-cve-2004-2761","children":[{"from":"CVE-2005-4900","to":"CVE-2022-39237","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-m5m3-46gj-wch8","via":"reference","url":"https://nvd.nist.gov/vuln/detail/cve-2005-4900"}]},{"from":"CVE-2005-4900","to":"CVE-2019-16370","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","from":"CVE.org","in":"CVE-2019-16370"}]}]}}