Enterprise Server 3.2 release notes

MEDIUM: A path traversal vulnerability was identified in GitHub Enterprise Server Management Console that allowed the bypass of CSRF protections. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23732.

MEDIUM: An integer overflow vulnerability was identified in the 1.x branch and the 2.x branch of yajil which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. This vulnerability was reported internally and has been assigned CVE-2022-24795.

Support bundles could include sensitive files if GitHub Actions was enabled.

Packages have been updated to the latest security versions.

Minio processes would have high CPU usage if an old configuration option was present after upgrading GitHub Enterprise Server.

The options to enable TLS 1.0 and TLS 1.1 in the Privacy settings of the Management Console were shown, although removal of those protocol versions occurred in an earlier release.

In a HA environment, configuring MSSQL replication could require additional manual steps after enabling GitHub Actions for the first time.

A subset of internal configuration files are more reliably updated after a hotpatch.

The ghe-run-migrations script would sometimes fail to generate temporary certificate names correctly.

In a cluster environment, Git LFS operations could fail with failed internal API calls that crossed multiple web nodes.

Pre-receive hooks that used gpg --import timed out due to insufficient syscall privileges.

In some cluster topologies, webhook delivery information was not available.

In HA configurations, tearing down a replica would fail if GitHub Actions had previously been enabled.

Elasticsearch health checks would not allow a yellow cluster status when running migrations.

Organizations created as a result of a user transforming their user account into an organization were not added to the global enterprise account.

When using ghe-migrator or exporting from GitHub.com, a long-running export would fail when data was deleted mid-export.

The GitHub Actions deployment graph would display an error when rendering a pending job.

Links to inaccessible pages were removed.

Navigating away from a comparison of two commits in the web UI would have the diff persist in other pages.

Adding a team as a reviewer to a pull request would sometimes show the incorrect number of members on that team.

The Remove team membership for a user API endpoint would respond with an error when attempting to remove a member managed externally by a SCIM group.

A large number of dormant users could cause a GitHub Connect configuration to fail.

The "Feature & beta enrollments" page in the Site admin web UI was incorrectly available.

The "Site admin mode" link in the site footer did not change state when clicked.

The spokesctl cache-policy rm command no longer fails with the message error: failed to delete cache policy.

Memcached connection limits were increased to better accommodate large cluster topologies.

The Dependency Graph API previously ran with a statically defined port.

The default shard counts for cluster-related Elasticsearch shard settings have been updated.

The “Triage” and “Maintain” team roles are preserved during repository migrations.

Performance has been improved for web requests made by enterprise owners.

HIGH: An integer overflow vulnerability was identified in GitHub's markdown parser that could potentially lead to information leaks and RCE. This vulnerability was reported through the GitHub Bug Bounty program by Felix Wilhelm of Google's Project Zero and has been assigned CVE-2022-24724.

Upgrades could sometimes fail if a high-availability replica's clock was out of sync with the primary.

OAuth Applications created after September 1st, 2020 were not able to use the Check an Authorization API endpoint.

It was possible for a user to register a user or organization named "saml".

Packages have been updated to the latest security versions.

GitHub Packages storage settings could not be validated and saved in the Management Console when Azure Blob Storage was used.

The mssql.backup.cadence configuration option failed ghe-config-check with an invalid characterset warning.

Fixes SystemStackError (stack too deep) when getting more than 2^{^16} keys from memcached.

Secret scanning will skip scanning ZIP and other archive files for secrets.

Packages have been updated to the latest security versions.

Pages would become unavailable following a MySQL secret rotation until nginx was manually restarted.

Migrations could fail when GitHub Actions was enabled.

When setting the maintenance schedule with a ISO 8601 date, the actual scheduled time wouldn't match due to the timezone not being transformed to UTC.

Spurious error messages concerning the cloud-config.service would be output to the console.

The version number would not be correctly updated after a installing a hotpatch using ghe-cluster-each.

Webhook table cleanup jobs could run simultaneously, causing resource contention and increasing job run time.

When run from the primary, ghe-repl-teardown on a replica would not remove the replica from the MSSQL availability group.

When using CAS authentication and the "Reactivate suspended users" option was enabled, suspended users were not automatically reactivated.

The ability to limit email-based notifications to users with emails on a verified or approved domain did not work correctly.

A long-running database migration related to Security Alert settings could delay upgrade completion.

The GitHub Connect data connection record now includes a count of the number of active and dormant users and the configured dormancy period.

Packages have been updated to the latest security versions. In these updates, Log4j has been updated to version 2.17.1. Note: previous mitigations released in 3.3.1, 3.2.6, 3.1.14, and 3.0.22 are sufficient to address the impact of CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832 in these versions of GitHub Enterprise Server.

Sanitize more secrets in the generated support bundles

Packages have been updated to the latest security versions.

Actions self hosted runners would fail to self-update or run new jobs after upgrading from an older GHES installation.

Storage settings could not be validated when configuring MinIO as blob storage for GitHub Packages.

Running ghe-config-apply could sometimes fail because of permission issues in /data/user/tmp/pages.

The save button in management console was unreachable by scrolling in lower resolution browsers.

IOPS and Storage Traffic monitoring graphs were not updating after collectd version upgrade.

Some webhook related jobs could generated large amount of logs.

Several documentation links resulted in a 404 Not Found error.

Critical: A remote code execution vulnerability in the Log4j library, identified as CVE-2021-44228, affected all versions of GitHub Enterprise Server prior to 3.3.1. The Log4j library is used in an open source service running on the GitHub Enterprise Server instance. This vulnerability was fixed in GitHub Enterprise Server versions 3.0.22, 3.1.14, 3.2.6, and 3.3.1. For more information, please see this post on the GitHub Blog.

December 17, 2021 update: The fixes in place for this release also mitigate CVE-2021-45046, which was published after this release. No additional upgrade for GitHub Enterprise Server is required to mitigate both CVE-2021-44228 and CVE-2021-45046.

Support bundles could include sensitive files if they met a specific set of conditions.

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2021-41598.

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2021-41599. Updated February 17, 2022.

In some cases when Actions was not enabled, ghe-support-bundle reported an unexpected message Unable to find MS SQL container.

Running ghe-config-apply could sometimes fail because of permission issues in /data/user/tmp/pages.

A misconfiguration in the Management Console caused scheduling errors.

Docker would hold log files open after a log rotation.

Migrations could get stuck due to incorrect handling of blob_path values that are not UTF-8 compatible.

GraphQL requests did not set the GITHUB_USER_IP variable in pre-receive hook environments.

Pagination links on org audit logs would not persist query parameters.

During a hotpatch, it was possible for duplicate hashes if a transition ran more than once.

Clarifies explanation of Actions path-style in documentation.

Updates support contact URLs to use the current support site, support.github.com.

Additional troubleshooting provided when running ghe-mssql-diagnostic.

Packages have been updated to the latest security versions.

Running ghe-repl-start or ghe-repl-status would sometimes return errors connecting to the database when GitHub Actions was enabled.

Pre-receive hooks would fail due to undefined PATH.

Running ghe-repl-setup would return an error: cannot create directory /data/user/elasticsearch: File exists if the instance had previously been configured as a replica.

Running ghe-support-bundle returned an error: integer expression expected.

After setting up a high availability replica, ghe-repl-status included an error in the output: unexpected unclosed action in command.

In large cluster environments, the authentication backend could be unavailable on a subset of frontend nodes.

Some critical services may not have been available on backend nodes in GHES Cluster.

The repository permissions to the user returned by the /repos API would not return the full list.

The childTeams connection on the Team object in the GraphQL schema produced incorrect results under some circumstances.

In a high availability configuration, repository maintenance always showed up as failed in stafftools, even when it succeeded.

User defined patterns would not detect secrets in files like package.json or yarn.lock.

An additional outer layer of gzip compression when creating a cluster support bundle with ghe-cluster-suport-bundle is now turned off by default. This outer compression can optionally be applied with the ghe-cluster-suport-bundle -c command line option.

We have added extra text to the admin console to remind users about the mobile apps' data collection for experience improvement purposes.

The GitHub Connect data connection record now includes a list of enabled GitHub Connect features. [Updated 2021-12-09]

A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker needed permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3, and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported through the GitHub Bug Bounty program and has been assigned CVE-2021-22870.

Packages have been updated to the latest security versions.

Some Git operations failed after upgrading a GitHub Enterprise Server 3.x cluster because of the HAProxy configuration.

Unicorn worker counts might have been set incorrectly in clustering mode.

Resqued worker counts might have been set incorrectly in clustering mode.

If Ubuntu's Uncomplicated Firewall (UFW) status was inactive, a client could not clearly see it in the logs.

Upgrading from GitHub Enterprise Server 2.x to 3.x failed when there were UTF8 characters in an LDAP configuration.

Some pages and Git-related background jobs might not run in cluster mode with certain cluster configurations.

The documentation link for Server Statistics was broken.

When a new tag was created, the push webhook payload did not display a correct head_commit object. Now, when a new tag is created, the push webhook payload now always includes a head_commit object that contains the data of the commit that the new tag points to. As a result, the head_commit object will always contain the commit data of the payload's after commit.

The enterprise audit log page would not display audit events for secret scanning.

There was an insufficient job timeout for replica repairs.

A repository's releases page would return a 500 error when viewing releases.

Users were not warned about potentially dangerous bidirectional unicode characters when viewing files. For more information, see "Warning about bidirectional Unicode text" in the GitHub Blog.

Hookshot Go sent distribution type metrics that Collectd could not handle, which caused a ballooning of parsing errors.

Public repositories displayed unexpected results from secret scanning with a type of Unknown Token.

Kafka configuration improvements have been added. When deleting repositories, package files are now immediately deleted from storage account to free up space. DestroyDeletedPackageVersionsJob now deletes package files from storage account for stale packages along with metadata records.

It was possible for cleartext passwords to end up in certain log files.

Several known weak SSH public keys have been added to the deny list and can no longer be registered. In addition, versions of GitKraken known to generate weak SSH keys (7.6.x, 7.7.x and 8.0.0) have been blocked from registering new public keys.

Packages have been updated to the latest security versions.

Restore might fail for enterprise server in clustering mode if orchestrator is not healthily.

Codespaces links were displayed in organization settings.

Several parts of the application were unusable for users who are owners of many organizations.

Fixed a link to https://docs.github.com.

Browsing and job performance optimizations for repositories with many refs.

Packages have been updated to the latest security versions.

Custom pre-receive hooks could have failed due to too restrictive virtual memory or CPU time limits.

In a GitHub Enterprise Server clustering configuration, Dependency Graph settings could have been incorrectly applied.

Attempting to wipe all existing configuration settings with ghe-cleanup-settings failed to restart the Management Console service.

During replication teardown via ghe-repl-teardown Memcached failed to be restarted.

During periods of high load, users would receive HTTP 503 status codes when upstream services failed internal healthchecks.

Pre-receive hook environments were forbidden from calling the cat command via BusyBox on Alpine.

Failing over from a primary Cluster datacenter to a secondary Cluster datacenter succeeds, but then failing back over to the original primary Cluster datacenter failed to promote Elasticsearch indicies.

The "Import teams" button on the Teams page for an Organization returned an HTTP 404.

Using the API to disable Secret Scanning correctly disabled the property but incorrectly returned an HTTP 422 and an error message.

In some cases, GitHub Enterprise Administrators attempting to view the Dormant users page received 502 Bad Gateway or 504 Gateway Timeout response.

Performance was negatively impacted in certain high load situations as a result of the increased number of SynchronizePullRequestJob jobs.

A user defined pattern created for Secret Scanning would continue getting scanned even after it was deleted.

GitHub Apps now set the Secret Scanning feature on a repository consistently with the API.

GitHub Advanced Security customers can now specify custom patterns for secret scanning. When a new pattern is specified, secret scanning searches a repository's entire Git history for the pattern, as well as any new commits.

User defined patterns are in beta for GitHub Enterprise Server 3.2. They can be defined at the repository, organization, and enterprise levels. For more information, see "Defining custom patterns for secret scanning."

GitHub Advanced Security customers now have an organization-level view of the application security risks detected by code scanning, Dependabot, and secret scanning. The security overview shows the enablement status of security features on each repository, as well as the number of alerts detected.

In addition, the security overview lists all secret scanning alerts at the organization level. Similar views for Dependabot and code scanning alerts are coming in future releases. For more information, see "About the security overview."

GitHub Advanced Security customers can now see a rich diff of the dependencies changed in a pull request. Dependency review provides an easy-to-understand view of dependency changes and their security impact in the "Files changed" tab of pull requests.