Skip to content

GREENGROUND

Daily Insights for a Smarter Tomorrow

Menu
  • Home
  • Medium
  • About Us
    • Mission
    • Contact Us
Menu

GitHub Revoked Insecure SSH Keys Generated by a Popular git Client

Posted on October 13, 2021 by Livio Andrea Acerbo
github


 Code hosting platform GitHub has revoked weak SSH authentication keys that were generated via the GitKraken git GUI client due to a vulnerability in a third-party library that increased the likelihood of duplicated SSH keys.

As an added precautionary measure, the Microsoft-owned company also said it’s building safeguards to prevent vulnerable versions of GitKraken from adding newly generated weak keys.

The problematic dependency, called “keypair,” is an open-source SSH key generation library that allows users to create RSA keys for authentication-related purposes. It has been found to impact GitKraken versions 7.6.x, 7.7.x, and 8.0.0, released between May 12, 2021, and September 27, 2021.

The flaw — tracked as CVE-2021-41117 (CVSS score: 8.7) — concerns a bug in the pseudo-random number generator used by the library, resulting in the creation of a weaker form of public SSH keys, which, owing to their low entropy — i.e., the measure of randomness — could boost the probability of key duplication.

“This could enable an attacker to decrypt confidential messages or gain unauthorized access to an account belonging to the victim,” keypair’s maintainer Julian Gruber said in an advisory published Monday. The issue has since been addressed in keypair version 1.0.4 and GitKraken version 8.0.1.

Axosoft engineer Dan Suceava has been credited with discovering the security weakness, while GitHub security engineer Kevin Jones has been acknowledged for identifying the cause and source code location of the bug. As of writing, there’s no evidence the flaw was exploited in the wild to compromise accounts.

Affected users are highly recommended to review and “remove all old GitKraken-generated SSH keys stored locally” and “generate new SSH keys using GitKraken 8.0.1, or later, for each of your Git service providers” such as GitHub, GitLab, and Bitbucket, among others.

Update: Along with GitHub, Microsoft Azure DevOps, GitLab, and Atlassian Bitbucket have also initiated mass revocations of SSH keys connected to accounts where the GitKraken client was used to synchronize source code, urging users to revoke the SSH public keys and generate new keys using the updated version of the app.

social experiment by Livio Acerbo #greengroundit #techcrunch https://techncruncher.blogspot.com/2021/10/github-revoked-insecure-ssh-keys.html

Share this:

  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on X (Opens in new window) X
  • Click to share on LinkedIn (Opens in new window) LinkedIn
  • Click to share on Tumblr (Opens in new window) Tumblr
  • Click to share on Mastodon (Opens in new window) Mastodon
  • More
  • Click to share on Reddit (Opens in new window) Reddit
  • Click to share on Pocket (Opens in new window) Pocket
  • Click to share on Telegram (Opens in new window) Telegram
  • Click to share on WhatsApp (Opens in new window) WhatsApp

Like this:

Like Loading...
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy
  • Twitter
  • Facebook
  • YouTube
  • Instagram
  • Telegram
©2025 GREENGROUND | WordPress Theme by Superbthemes.com
This website uses cookies
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.Accept Reject Read More
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT
%d