Mozilla Replaces Firefox Signing Key After Accidental Exposure
Summary
Mozilla replaced a GPG signing subkey after an unencrypted copy was accidentally committed to a private GitHub repository. Mozilla said its audit found no evidence of unauthorized access; some users must import the replacement key.
Key points
- The exposed key signed some Firefox and Thunderbird artifacts, including Linux tarballs, RPM packages, and checksum files.
- An unencrypted copy was accidentally committed to a private GitHub repository accessible to a small group of Mozilla developers.
- Mozilla said its review of available audit records found no evidence that an unauthorized party accessed the key.
- Mozilla revoked the exposed key, issued a replacement, and added protections against similar incidents.
- Most users do not need to act; users who manually verify GPG signatures must import the new key and the old key’s revocation. Some Firefox RPM users may also need to follow Mozilla’s instructions.
Article Details
- Event Type
- Accidental exposure and revocation of a software-signing GPG key
- Impact
- The exposed key had been used to sign some Firefox and Thunderbird artifacts, creating a potential risk that malicious files could be signed and presented as authentic. Mozilla said its review of available audit records found no evidence of unauthorized access; the key was in a private repository accessible to a small group of developers who already had access to it. Mozilla revoked the key, issued a replacement, and added protections. Users who manually verify signatures need to import the new key and the old key’s revocation; some Firefox RPM users may also need to follow Mozilla’s instructions.
Vendors
Products
Mozilla FirefoxMozilla announced on Monday that it has issued a new GPG signing subkey used for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository.Mozilla ThunderbirdMozilla announced on Monday that it has issued a new GPG signing subkey used for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository.