Microsoft revoked insecure SSH keys some Azure DevOps have generated using a GitKraken git GUI client version impacted by an underlying issue found in one of its dependencies.
Azure DevOps is a Microsoft cloud service specifically designed for code development collaboration with an integrated set of features accessible through an integrated development environment (IDE) client or web browser.
The decision to revoke the keys was taken after GitKraken's developer Axosoft notified Microsoft on September 28 that a bug in the keypair library's pseudo-random number generator led to duplicate RSA keys being generated.
If Microsoft hadn't revoked them, the duplicate SSH keys would've allowed Azure DevOps customers to access other users' accounts.
"In response to this disclosure, we conducted a security investigation of the reported vulnerability and identified a small set of users across our service with potentially insecure SSH keys generated through affected versions of GitKraken," Microsoft explained.
"We revoked all the affected SSH keys generated through affected versions of GitKraken on 10/11/2021. We will also directly inform those individuals whose SSH keys were revoked within the next 24 hours."
Microsoft recommends switching to new SSH keys
While Azure DevOps customers who haven't already been informed their SSH keys were revoked are likely unaffected by this vulnerability, Microsoft still advises them to add new SSH public keys to Azure DevOps Services/TFS.
Detailed information on removing your SSH public keys and adding new ones is available on Microsoft's support website.
Yesterday, GitHub also announced that it revoked weak SSH authentication keys generated with GitKraken versions using the faulty library, which created duplicate keypairs incorrectly.
The library flaw was discovered by Axosoft engineer Dan Suceava "who noticed that keypair was regularly generating duplicate RSA keys," and GitHub senior security engineer Kevin Jones identified the cause.
To protect their users, GitHub revoked all keys generated by GitKraken and other potentially weak keys created by other git clients using the same buggy keypair library version.
Bitbucket and GitLab also revoked weak public keys their customers generated with older GitKraken versions on Tuesday.