Credential Rotations Complete, GHES Patched After GitHub Bug Bounty Report

GitHub has completed a credential rotation triggered by a bug bounty report received on December 26, 2023. A researcher demonstrated a vulnerability that could allow access to credentials inside a production container. GitHub fixed the issue on GitHub.com the same day and rotated all potentially exposed credentials.

Based on telemetry and logging analysis, GitHub assesses with high confidence that the vulnerability was not previously discovered or exploited. The impact was isolated to the bug bounty researcher. The company rotated credentials as a precautionary measure, per its standard procedures.

GitHub Enterprise Server Patches

GitHub Enterprise Server (GHES) is also affected by the vulnerability. However, exploitation on GHES requires an authenticated user with a organization owner role to be logged into an account on the instance. Patches are available today, January 16, 2024, for GHES versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3.

The credential rotations across GitHub's production systems caused service disruptions between December 27 and 29. GitHub has updated its rotation procedures to minimize the risk of unplanned downtime in future rotations.

New GPG Commit Signing Key

Starting today, all commits created on GitHub—whether via the web editor, a codespace, or pull request operations—are signed with a new GPG key. The previous private signing key expired on January 16, 2024 at 20:00:00 UTC. Commits uploaded after January 23, 2024 that are signed with the previous key will no longer display as verified.

Users who verify GitHub-signed commits outside of GitHub (including for verification in GHES) must import the new public key. GitHub recommends regularly pulling this public key to stay current with the latest key material.

Users with a GitHub Codespace that has commit signing enabled and who have unpushed commits created before January 16, 2024 must push those commits before January 23, 2024. After that date, those older commits will no longer be marked verified unless resigned, which can be done using the amend flag or an equivalent method. No action is required for users who sign commits with their own GPG key.

Secrets Encryption Key Rotation

GitHub has also rotated the public keys used to encrypt GitHub Actions, GitHub Codespaces, and Dependabot secrets before they are sent to GitHub via the API. This rotation was completed on January 16, 2024.

Users who have hardcoded or cached the old public keys for these endpoints may see an error when sending new secrets:

Provided key #{key_identifier} is not the latest version available. Call GET /secrets/public-key and resign the data using the latest key.

The affected endpoints include:

GitHub recommends pulling public keys from the API regularly to ensure you're using current data. This also simplifies future key adoptions.

Acknowledgement

GitHub credited Ngo Wei Lin (@Creastery) of STAR Labs (@starlabs_sg) for reporting the vulnerability through the GitHub Bug Bounty Program and practicing safe security research under the program's rules of engagement. Future reports can be submitted via HackerOne.