GitHub Revoked Insecure SSH Keys Generated by a Popular git Client

github

Code hosting platform GitHub has revoked weak SSH authentication keys that were generated via the GitKraken git GUI client due to a vulnerability in a third-party library that increased the likelihood of duplicated SSH keys.

[embedded content]

As an added precautionary measure, the Microsoft-owned company also said it’s building safeguards to prevent vulnerable versions of GitKraken from adding newly generated weak keys.

The problematic dependency, called “keypair,” is an open-source SSH key generation library that allows users to create RSA keys for authentication-related purposes. It has been found to impact GitKraken versions 7.6.x, 7.7.x, and 8.0.0, released between May 12, 2021, and September 27, 2021.

The flaw — tracked as CVE-2021-41117 (CVSS score: 8.7) — concerns a bug in the pseudo-random number generator used by the library, resulting in the creation of a weaker form of public SSH keys, which, owing to their low entropy — i.e., the measure of randomness — could boost the probability of key duplication.

“This could enable an attacker to decrypt confidential messages or gain unauthorized access to an account belonging to the victim,” keypair’s maintainer Julian Gruber said in an advisory published Monday. The issue has since been addressed in keypair version 1.0.4 and GitKraken version 8.0.1.

Axosoft engineer Dan Suceava has been credited with discovering the security weakness, while GitHub security engineer Kevin Jones has been acknowledged for identifying the cause and source code location of the bug. As of writing, there’s no evidence the flaw was exploited in the wild to compromise accounts.

[embedded content]

Affected users are highly recommended to review and “remove all old GitKraken-generated SSH keys stored locally” and “generate new SSH keys using GitKraken 8.0.1, or later, for each of your Git service providers” such as GitHub, GitLab, and Bitbucket, among others.

Update: Along with GitHub, Microsoft Azure DevOps, GitLab, and Atlassian Bitbucket have also initiated mass revocations of SSH keys connected to accounts where the GitKraken client was used to synchronize source code, urging users to revoke the SSH public keys and generate new keys using the updated version of the app.

Subscribe

Category

Related posts

Latest posts

U.S. FDA advisers vote in favor of Pfizer/BioNTech COVID-19 vaccine in young kids

Sign In/Free Sign Up 0 Stock Markets1 minute ago (Oct 26, 2021 04:26PM ET) 2/2 (C) Reuters. FILE PHOTO: A vial labelled with the Pfizer-BioNTech...

Major issues unresolved as Democrats in U.S. Congress seek deal on spending bill

2/2 (C) Reuters. FILE PHOTO: U.S. Senator Joe Manchin (D-WV) walks through the U.S. Capitol in Washington, U.S., October 21, 2021. REUTERS/Elizabeth Frantz/File Photo 2/2 By Richard...

Oil Near Highs As Trade Awaits Weekly U.S. Inventory Snapshot

Commodities44 minutes ago (Oct 26, 2021 03:44PM ET) (C) Reuters. By Barani Krishnan Investing.com - Crude prices were near multi-year highs on Tuesday as market...