Access key with a weak SSH signature was detected in SCM

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_70
Category	IAM
Severity	LOW

Impact

Repository access keys created with weak signature algorithms can allow attackers to perform a Man In The Middle attack and compromise the integrity and confidentiality of the communications with the SCM. An access key created with the deprecated ssh-dss algorithm is in use in the Bitbucket workspace. The algorithm was deprecated in OpenSSH 7.0: http://www.openssh.com/legacy

Recommended Solution - Buildtime

Revoke all ssh-dss keys in use. Instead, use any of the following supported OpenSSH key types:

• ecdsa
• ecdsa-sk
• ed25519
• ed25519-sk
• rsa

To replace an access key:

1. Create a new private key on the server intended to use it, using one of the recommended algorithms.
2. Create a new access key using the matching public key in the same repository that the current key was created on.
3. Direct the server to use the new access key.
4. Delete the older access key from the Bitbucket repository.

Create and delete access keys

• Create and delete access keys through the console: Browse to the Deploy Keys tab under the repository Settings.
• Create and delete access keys through the API: Refer to the Bitbucket API documentation:https://developer.atlassian.com/cloud/bitbucket/rest/api-group-deployments/#api-repositories-workspace-repo-slug-deploy-keys-post.