Security News > 2021 > October > Microsoft revokes insecure SSH keys for Azure DevOps customers
Microsoft revoked insecure SSH keys some Azure DevOps have generated using a GitKraken git GUI client version impacted by an underlying issue found in one of its dependencies.
The decision to revoke the keys was taken after GitKraken's developer Axosoft notified Microsoft on September 28 that a bug in the keypair library's pseudo-random number generator led to duplicate RSA keys being generated.
If Microsoft hadn't revoked them, the duplicate SSH keys would've allowed Azure DevOps customers to access other users' accounts.
"In response to this disclosure, we conducted a security investigation of the reported vulnerability and identified a small set of users across our service with potentially insecure SSH keys generated through affected versions of GitKraken," Microsoft explained.
"We revoked all the affected SSH keys generated through affected versions of GitKraken on 10/11/2021. We will also directly inform those individuals whose SSH keys were revoked within the next 24 hours."
While Azure DevOps customers who haven't already been informed their SSH keys were revoked are likely unaffected by this vulnerability, Microsoft still advises them to add new SSH public keys to Azure DevOps Services/TFS. Detailed information on removing your SSH public keys and adding new ones is available on Microsoft's support website.