GitHub Revokes SSH Keys Produced by GitKraken’s Vulnerable Dependency
GitHub has revoked SSH keys generated by specific versions of the GitKraken git client after a vulnerability was disclosed in a third-party dependency. The issue stems from the keypair library, which GitKraken versions 7.6.x, 7.7.x, and 8.0.0 relied on to create SSH keys. These versions produced weak keys due to the underlying flaw in that dependency.
As of 1700 UTC today, GitHub has revoked all keys generated by the affected GitKraken versions that were registered with GitHub.com accounts. The company also took action against other potentially weak keys created by other clients and integrators that may have used the same vulnerable library. Because the nature of the flaw makes it impossible to enumerate every key produced by the library, GitHub chose to revoke additional keys believed to be associated with the affected dependency as a precaution.
Additionally, GitHub has put protections in place to stop the older, vulnerable GitKraken client versions from adding newly generated weak keys to accounts in the future.
What Users Should Do
GitHub notes that this was not the result of a security compromise or data breach of their systems. However, users are advised to review the SSH keys attached to their accounts and rotate any that may have been produced with the insecure library. Instructions for checking SSH keys are available in GitHub’s documentation. Enterprise Server administrators can inspect SSH keys added to their instances by looking at public_key.create entries in the site admin dashboard audit log, where records can be filtered by user agent to identify clients that may be affected.
GitHub acknowledged Axosoft, the developer of GitKraken, for promptly reporting the problem, and Julian Gruber for working with GitHub Security Lab to address the issue in the keypair library. The related advisory is documented as GHSA-3f99-hvg4-qjwj. More details can be found in GitKraken’s blog post about the weak SSH key issue and its fix.
