Mozilla Rotates Firefox and Thunderbird Signing Key After Exposure
Summary
Mozilla rotated and revoked a signing key after an unencrypted copy was committed to a private GitHub repository. It found no evidence of unauthorized access and advises some Linux and manual signature-verification users to update their trust data.
Key points
- An unencrypted copy of the previous GPG signing subkey was accidentally committed to a private GitHub repository.
- Mozilla says access to the repository was limited and its audit review found no evidence that unauthorized parties accessed the key.
- The revoked key signed certain Firefox and Thunderbird artifacts, including Linux tarballs, RPM packages, and checksum files.
- Users who manually verify signatures must import the new signing key and the revocation for the old key.
- Some Linux users installing Firefox through RPM packages may need to update their systems; Thunderbird users do not need an RPM-specific action.
Article Details
- Event Type
- Exposure and rotation of a software release-signing key
- Impact
- An unencrypted copy of Mozilla’s previous GPG signing subkey was accidentally committed to a private GitHub repository. Mozilla reported no evidence of unauthorized access and assessed the risk of supply-chain abuse as low. It revoked the old key; some Linux users and users who manually verify signatures must update their key and revocation data.
Vendors
Products
Mozilla FirefoxMozilla updated the GPG key used to sign Firefox and Thunderbird releases after an unencrypted copy was accidentally committed to a private GitHub repository.Mozilla ThunderbirdMozilla updated the GPG key used to sign Firefox and Thunderbird releases after an unencrypted copy was accidentally committed to a private GitHub repository.