UPDATE: 13-Jan-2022 21:22 UTC Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert. …

Today we published incident report for our security incident disclosed on January 4 on our blog here: [image] CircleCI incident report for January 4, 2023 security incident Read the complete incident report from CircleCI’s January 4, 2023 security alert.

[image] H4ZM47: Does this incident impact self-hosted CircleCI environments in addition to the SaaS version? [image] SlowIsSmoothIsFast: Same question [image] timtai: Does this incident affect CircleCI Enterprise version? For CircleCI server customers (full self-hosted installat…

[image] u-santos: Hi jerdog. With this failure of CircleCI, the organization I work for has more than 270 projects, and each one with its own secrets -aws, ssh, deployment, auth tokens… Can you give me some idea of what we can do? Is there any solution other than going from one to one changing a…

Does it apply to self hosted runners? What is the expected remediation? We are using the saas version with self hoster runners running in K8s? Should I rotate the resource classes tokens?

Reading through the Rotating Secrets doc (https://support.circleci.com/hc/en-us/articles/11816211460891) for integrating with Github I’m a little confused. Does each individual user need to revoke their oAuth tokens in GitHub individual, or can we remove then re-approve CircleCI under the " Third-p…

[image] tthayer: Is there a particular thing we should be looking for in the circle org audit log? I see a fair number of ‘unregistered’ values in the ACTOR_TYPE column but don’t know what that indicates. These are users who do not have a CircleCI account, but interact with your repositories. …

[image] AlonGluz: Does it apply to self hosted runners? What is the expected remediation? We are using the saas version with self hoster runners running in K8s? Should I rotate the resource classes tokens? Yes, this applies to all tokens associated

Could we start a thread here of any IOC’s that people have discovered in their investigations? We saw this one already: 54.145.167.181https://infosec.exchange/@sanitybit/109634301629418182 Can CircleCI start giving out some intel for the rest of us to keep our own orgs safe?

[image] Vespinosa: So, are we safe rotating all the environment variables? How do we know that this is not still open/vulnerable? To be honest, the information provided about the issue is really poor. At this point, we are confident that there are no unauthorized actors active in our systems;…

[image] marguerite: Is there a way to audit which users have access tokens that should be rotated? Out of an abundance of caution, it is important that you rotate any and all secrets stored in CircleCI. Please refer to the support article posted above [image] Rotating Secrets for Jan…

[image] ring-pete: Reading through the Rotating Secrets doc (https://support.circleci.com/hc/en-us/articles/11816211460891) for integrating with Github I’m a little confused. Does each individual user need to revoke their oAuth tokens in GitHub individual, or can we remove then re-approve Circle…

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Announcements Security

jerdog January 5, 2023, 7:31pm 66

Yes, this applies to all tokens associated

Topic		Replies	Views
[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI Security	1	4466	January 5, 2023
Rotating all of the Organizations Deploy keys Tips, Tricks, and Hacks api	1	1447	October 31, 2022
Deployment is broken after rotating secrets Deployments rails , circle-yml	3	1057	January 12, 2023
Generate a new API token Build Environment api	1	1780	June 15, 2017
Debug with SSH has stopped working in BitBucket Bug Reports	55	7121	April 8, 2019

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

Related topics