GitHub has revoked an unknown number of cryptographic keys used to access accounts after a developer found they contained a catastrophic weakness that came to light some seven years ago.. The keys, which allow authorized users to log into public repository accounts belonging to the likes of Spotify, Yandex, and UK government developers, were generated using a buggy pseudo random number generator originally contained in the Debian distribution of Linux. During a 20-month span from 2006 to 2008, the pool of numbers available was so small that it made cracking the secret keys trivial. Almost seven years after Debian maintainers patched the bug and implored users to revoke old keys and regenerate new ones, London-based developer Ben Cartwright-Cox said he discovered the weakness still resided in a statistically significant number of keys used to gain secure shell (SSH) access to GitHub accounts.. Coders cautioned regarding vulnerable encryption keys employed for GitHub profiles following identification of security threats stemming from an earlier Debian flaw.. GitHub Security, Cryptographic Keys, Key Vulnerabilities, SSH Access, Debian Bug. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.