Data BreachBleeping Computer
2.0 — LOW
Mozilla updates GPG signing key for Firefox releases after exposure
Mozilla announced today that it updated the GPG key used to sign Firefox and Thunderbird releases after it was accidentally exposed on GitHub. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Mozilla accidentally exposed its GPG signing key on GitHub, but the risk of a supply chain attack is low due to limited access to the repository. The organization has since updated its signing key and taken measures to prevent similar issues in the future.
⚙️Technical Details
Affected Systems
FirefoxThunderbird
Attack Vectors
Supply chain attack via malicious installers signed with exposed GPG key
💥Impact Assessment
Severity: low
Who Is at Risk
Users who manually verify GPG signatures and Linux users who install Firefox using RPM packages
🛡️Recommended Actions
1Import the new signing key and revocation for the old key
2Manually update systems running Fedora 43 and later, Fedora 42 and older, RHEL/Rocky/Almalinux, and openSUSE/SUSE-based distributions
3Verify GPG signatures manually
📦Affected Products
FirefoxThunderbird
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.