Re:Update Your Bitbucket Cloud SSH Host Keys
by stygiansonic on Monday May 15, 2023 @09:37PM
(#35956811)
The key parts
We recently learned that encrypted copies of Bitbucket’s SSH host keys were included in a data breach of a third-party credential management vendor. The SSH protocol uses host keys to establish the identity of a trusted server for every SSH connection, like when a git pull establishes a SSH connection to Bitbucket Cloud.
In response, Bitbucket issued two new SSH host keys today and will be replacing the current host keys on June 20, 2023. Please review this blog and complete the applicable steps outlined below as soon as possible.
I'm not a security expert, but isn't it concerning that their SSH host private key was even accessible this way? (In a "third-party credential management vendor")
We recently learned that encrypted copies of Bitbucket’s SSH host keys were included in a data breach of a third-party credential management vendor. The SSH protocol uses host keys to establish the identity of a trusted server for every SSH connection, like when a git pull establishes a SSH connection to Bitbucket Cloud.
In response, Bitbucket issued two new SSH host keys today and will be replacing the current host keys on June 20, 2023. Please review this blog and complete the applicable steps outlined below as soon as possible.
I'm not a security expert, but isn't it concerning that their SSH host private key was even accessible this way? (In a "third-party credential management vendor")