Deploy key has a weak SSH signature

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_36
Category	IAM
Severity	LOW

Impact

Repository deploy keys created with weak signature algorithms can allow attackers to perform a Man In The Middle attack and compromise the integrity and confidentiality of the communications with the SCM. A deploy key created with the deprecated ssh-dss algorithm is in use in the GitHub organization. The algorithm was deprecated in OpenSSH 7.0: http://www.openssh.com/legacy

Recommended Solution - Buildtime

Revoke all ssh-dss keys in use. Instead, use any of the following supported OpenSSH key types:

• ecdsa
• ecdsa-sk
• ed25519
• ed25519-sk
• rsa

To replace a deploy key:

1. Create a new private key on the server intended to use it, using one of the recommended algorithms.
2. Create a new deploy key using the matching public key in the same repository that the current key was created on.
3. Direct the server to use the new deploy key.
4. Delete the older deploy key from the GitHub repository.

Create and delete access keys

• Create and delete deploy keys through the console: Browse to the Deploy Keys tab under the repository settings.
• Create and delete deploy keys through the API: Refer to the GitHub API documentation: https://docs.github.com/en/rest/reference/repos#deploy-keys.