GitHub has taken immediate action in response to the discovery of a high-severity vulnerability within GitHub Enterprise Server (GHES). The vulnerability, tracked as CVE-2024-0200, could have potentially exposed credentials to threat actors. In a prompt and decisive move, GitHub has rotated encryption keys to ensure the safety and security of its users’ data.
Furthermore, GitHub has diligently addressed another bug related to command injection. This proactive approach to cybersecurity reflects GitHub’s commitment to maintaining a secure and trustworthy platform for developers and users alike.
GitHub has also proactively replaced its RSA SSH host key as a precaution. This step demonstrates GitHub’s dedication to staying ahead of potential threats and continuously enhancing its security protocols.
These crucial security measures were implemented following the detection of the vulnerability, thanks to GitHub’s Bug Bounty Program. The program serves as an essential component of GitHub’s comprehensive security framework and allows for the identification and timely resolution of potential vulnerabilities.
GitHub assures its users that there is currently no evidence of exploitation in the wild. By rotating credentials, fixing vulnerabilities, and providing patches for GHES, GitHub remains committed to safeguarding its users’ valuable data and maintaining a secure development environment.

Collections

GitHub has addressed a high-severity vulnerability in GitHub Enterprise Server, rotating credentials and enhancing security protocols. They have also replaced their RSA SSH host key as a precaution.

Addressing High-Severity Vulnerability: GitHub Rotates Credentials and Fixes Vulnerability