vulnerability
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
High
Summary
Mozilla has revoked a cryptographic key used to sign Firefox and Thunderbird downloads for Linux after an unencrypted copy was accidentally committed to a private repository. This affects older downloads and requires manual intervention for some users, particularly those checking signatures manually or installing from RPM packages. The incident highlights a key rotation process and a recent GitHub breach targeting repository keys. No APT users are affected.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data