GitKraken SSH Bug – GitKraken library generated weak or insecure SSH keys

guest · Oct 11, 2021

GitHub revokes duplicate SSH auth keys linked to library bug
October 11, 2021
https://www.bleepingcomputer.com/ne...uplicate-ssh-auth-keys-linked-to-library-bug/

GitHub has revoked weak SSH authentication keys generated using a library that incorrectly created duplicate RSA keypairs.

GitHub allows you to authenticate to their service without a user name and password using the SSH protocol. To do this, users would generate an SSH keypair and add the public key to their accounts' SSH key setting.
Click to expand...

GitHub revokes weak SSH keys
Today, in a coordinated disclosure between GitHub and Axosoft, LLC., the makers of the popular GitKraken Git client, GitHub said they revoked weak SSH keys generated by the 'keypair' library used by the software.

"An underlying issue with a dependency, called keypair, resulted in the GitKraken client generating weak SSH keys. This issue affected versions 7.6.x, 7.7.x, and 8.0.0 of the GitKraken client, and you can read GitKraken’s disclosure on their blog," disclosed GitHub today in a new security advisory.
Click to expand...

A bug in the library's pseudo-random number generator allowed for the generation of duplicate RSA keys, enabling users to access other GitHub accounts secured with the same SSH key.

"A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.3 or earlier," explained the Keypair advisory.
The bug was discovered by Axosoft engineer Dan Suceava, "who noticed that keypair was regularly generating duplicate RSA keys."
Click to expand...

guest · Oct 12, 2021

Microsoft revokes insecure SSH keys for Azure DevOps customers
October 12, 2021
https://www.bleepingcomputer.com/ne...insecure-ssh-keys-for-azure-devops-customers/

Microsoft revoked insecure SSH keys some Azure DevOps have generated using a GitKraken git GUI client version impacted by an underlying issue found in one of its dependencies.

The decision to revoke the keys was taken after GitKraken's developer Axosoft notified Microsoft on September 28 that a bug in the keypair library's pseudo-random number generator led to duplicate RSA keys being generated.
Click to expand...

If Microsoft hadn't revoked them, the duplicate SSH keys would've allowed Azure DevOps customers to access other users' accounts.

"In response to this disclosure, we conducted a security investigation of the reported vulnerability and identified a small set of users across our service with potentially insecure SSH keys generated through affected versions of GitKraken," Microsoft explained.
Click to expand...

Microsoft recommends switching to new SSH keys
While Azure DevOps customers who haven't already been informed their SSH keys were revoked are likely unaffected by this vulnerability, Microsoft still advises them to add new SSH public keys to Azure DevOps Services/TFS.
Detailed information on removing your SSH public keys and adding new ones is available on Microsoft's support website.
Click to expand...

Bitbucket and GitLab also revoked weak public keys their customers generated with older GitKraken versions on Tuesday.
Click to expand...

Log in or Sign up

GitKraken SSH Bug – GitKraken library generated weak or insecure SSH keys

guest Guest

guest Guest

Log in or Sign up

GitKraken SSH Bug – GitKraken library generated weak or insecure SSH keys

guest Guest

guest Guest

Useful Searches