On September 28, 2021, we received notice from the developer Axosoft regarding a vulnerability in a dependency of their popular git GUI client – GitKraken. An underlying issue with a dependency, called keypair, resulted in the GitKraken client generating weak SSH keys. This issue affected versions 7.6.x, 7.7.x, and 8.0.0 of the GitKraken client, and you can read GitKraken’s disclosure on their blog.
Today as of 1700 UTC, we’ve revoked all keys generated by these vulnerable versions of the GitKraken client that were in use on GitHub.com, along with other potentially weak keys created by other clients that may have used the same vulnerable dependency. In addition to revoking these keys, we have also implemented protections to prevent vulnerable versions of GitKraken from adding newly-generated weak keys by the older, vulnerable versions of the client in the future.
We also investigated the possibility that weakly-generated keys in use on GitHub.com came from other third-party clients and integrators also using this vulnerable library. The nature of this vulnerability prevents us from identifying all possible weak SSH keys produced by this library and vulnerable clients that used it. Out of an abundance of caution, we’ve also revoked other potentially weak keys associated with these scenarios and blocked their use.
Users whose keys have been revoked by GitHub are being directly notified. This was not the result of a compromise, data breach, or other data exposure event of GitHub or our systems, but rather an issue with a library commonly used to generate SSH keys for use with GitHub.
What does GitHub recommend?
We recommend that you review SSH keys linked to your GitHub account and rotate any keys that could have been generated using the vulnerable / insecure library. For information on how to review your SSH keys, visit https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys.
Administrators of GitHub Enterprise Server deployments can review the SSH keys added to their instances by reviewing public_key.create actions in the site admin dashboard audit log. These results can be filtered to specific user agents to identify potentially vulnerable clients.
GitHub would like to thank Axosoft for reaching out to GitHub immediately and informing us of this issue. We would also like to thank Julian Gruber for working with GitHub Security Lab to quickly address the underlying issue in the keypair library and their collaboration on GHSA-3f99-hvg4-qjwj.
For more information, please visit GitKraken’s blog post at https://www.gitkraken.com/blog/weak-ssh-key-issue-fix. For questions related to GitKraken, please contact their support team at support@gitkraken.com.
Written by
Mike Hanley is the Chief Security Officer and SVP of Engineering at GitHub. Prior to GitHub, Mike was the Vice President of Security at Duo Security, where he built and led the security research, development, and operations functions. After Duo’s acquisition by Cisco for $2.35 billion in 2018, Mike led the transformation of Cisco’s cloud security framework and later served as CISO for the company. Mike also spent several years at CERT/CC as a Senior Member of the Technical Staff and security researcher focused on applied R&D programs for the US Department of Defense and the Intelligence Community.
When he’s not talking about security at GitHub, Mike can be found enjoying Ann Arbor, MI with his wife and eight kids.
