Enterprise Server 3.2 release notes

HIGH: A GitHub App could use a scoped user-to-server token to bypass user authorization logic and escalate privileges.

MEDIUM: The use of a Unicode right-to-left override character in the list of accessible files for a GitHub App could obscure additional files that the app could access.

Packages have been updated to the latest security versions.

In a cluster configuration, running ghe-cluster-config-apply could cause unconfigured nodes to replicate configuration to the rest of the cluster, potentially removing configurations from existing nodes.

In some cases, the Management Console's monitor dashboard would not load correctly.

When sending a support bundle to GitHub Enterprise Support using ghe-support-upload, the -t option would not successfully associate the uploaded bundle with the specified ticket.

After a user deleted or restored packages from the web interface, counts for packages could render incorrectly.

Manually disabled GitHub Actions workflows in a repository were re-enabled if the repository received a push containing more than 2048 commits, or if the repository's default branch changed.

When using a VPC endpoint URL as an AWS S3 URL for GitHub Packages, publication and installation of packages failed.

Duplicate administrative SSH keys could appear in both the Management Console and the /home/admin/.ssh/authorized_keys file.

In some cases, background tasks could stall due to a library that was used concurrently despite not being thread-safe.

Generation of support bundles is faster as a result of parallelized log sanitization. For more information about support bundles, see "Providing data to GitHub Support."

CRITICAL: GitHub Enterprise Server's Elasticsearch container used a version of OpenJDK 8 that was vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. The vulnerability is tracked as CVE-2022-34169.

HIGH: Previously installed apps on user accounts were automatically granted permission to access an organization on scoped access tokens after the user account was transformed into an organization account. This vulnerability was reported via the GitHub Bug Bounty program.

When a custom dormancy threshold was set for the instance, suspending all dormant users did not reliably respect the threshold. For more information about dormancy, see "Managing dormant users."

MEDIUM: Prevents an attack where a server-side request forgery (SSRF) could potentially force the Subversion (SVN) bridge to execute remote code by injecting arbitrary data into Memcached.

Updates Grafana to version 7.5.16, which addresses various security vulnerabilities including CVE-2020-13379 and CVE-2022-21702.

Packages have been updated to the latest security versions.

Fixed an issue where the files inside the artifact zip archives had permissions of 000 when unpacked using an unzip tool. Now the files will have the permissions set to 644, the same way as it works in GitHub.com.

In some cases, the collectd daemon could consume excess memory.

In some cases, backups of rotated log files could accumulate and consume excess storage.

After an upgrade to a new feature release and subsequent configuration run, Elasticsearch could log excessive exceptions while rebuilding indices.

In some cases where a protected branch required more than one approving review, a pull request could be merged with fewer than the required number of approving reviews.

On instances using LDAP authentication, the authentication prompt for sudo mode incorrectly placed the cursor within the password field by default when text fields for both a username and password were visible.

The ghe-set-password command-line utility starts required services automatically when the instance is booted in recovery mode.

Metrics for aqueduct background processes are gathered for Collectd forwarding and display in the Management Console.

The location of the database migration and configuration run log, /data/user/common/ghe-config.log, is now displayed on the page that details a migration in progress.

MEDIUM: Ensures that github.company.com and github-company.com are not evaluated by internal services as identical hostnames, preventing a potential server-side security forgery (SSRF) attack.

LOW: An attacker could access the Management Console with a path traversal attack via HTTP even if external firewall rules blocked HTTP access.

Packages have been updated to the latest security versions.

In some cases, site administrators were not automatically added as enterprise owners.

After merging a branch into the default branch, the "History" link for a file would still link to the previous branch instead of the target branch.

Creating or updating check runs or check suites could return 500 Internal Server Error if the value for certain fields, like the name, was too long.

Packages have been updated to the latest security versions.

An internal script to validate hostnames in the GitHub Enterprise Server configuration file would return an error if the hostname string started with a "." (period character).

In HA configurations where the primary node's hostname was longer than 60 characters, MySQL would fail to be configured.

The --gateway argument was added to the ghe-setup-network command, to allow passing the gateway address when configuring network settings using the command line.

Image attachments that were deleted would return a 500 Internal Server Error instead of a 404 Not Found error.

The calculation of "maximum committers across entire instance" reported in the site admin dashboard was incorrect.

An incorrect database entry for repository replicas caused database corruption when performing a restore using GitHub Enterprise Server Backup Utilities.

Optimised the inclusion of metrics when generating a cluster support bundle.

In HA configurations where Elasticsearch reported a valid yellow status, changes introduced in a previous fix would block the ghe-repl-stop command and not allow replication to be stopped. Using ghe-repo-stop --force will now force Elasticsearch to stop when the service is in a normal or valid yellow status.

MEDIUM: A security issue in nginx resolver was identified, where an attacker who could forge UDP packets from the DNS server could cause 1-byte memory overwrite, resulting in worker process crashes or other potentially damaging impacts. The vulnerability has been assigned CVE-2021-23017.

Updated the actions/checkout@v2 and actions/checkout@v3 actions to address new vulnerabilities announced in the Git security enforcement blog post.

Packages have been updated to the latest security versions.

In some cluster topologies, the ghe-cluster-status command left behind empty directories in /tmp.

SNMP incorrectly logged a high number of Cannot statfs error messages to syslog.

For instances configured with SAML authentication and built-in fallback enabled, built-in users would get stuck in a “login” loop when attempting to sign in from the page generated after logging out.

Videos uploaded to issue comments would not be rendered properly.

When using SAML encrypted assertions, some assertions were not correctly marking SSH keys as verified.

When using ghe-migrator, a migration would fail to import video file attachments in issues and pull requests.

The Releases page would return a 500 error when the repository has tags that contain non-ASCII characters. [Updated: 2022-06-10]

In high availability configurations, clarify that the replication overview page in the Management Console only displays the current replication configuration, not the current replication status.

When enabling GitHub Packages, clarify that using a Shared Access Signature (SAS) token as connection string is not currently supported.

Support bundles now include the row count of tables stored in MySQL.

Dependency Graph can now be enabled without vulnerability data, allowing you to see what dependencies are in use and at what versions. Enabling Dependency Graph without enabling GitHub Connect will not provide vulnerability information.

Packages have been updated to the latest security versions.

Upgrading the nodes in a high availability pair with an upgrade package could cause Elasticsearch to enter an inconsistent state in some cases.

In some cluster topologies, the command line utilities ghe-spokesctl and ghe-btop failed to run.

Elasticsearch indices could be duplicated during a package upgrade, due to an elasticsearch-upgrade service running multiple times in parallel.

When converting a user account to an organization, if the user account was an owner of the GitHub Enterprise Server enterprise account, the converted organization would incorrectly appear in the enterprise owner list.

Creating an impersonation OAuth token using the Enterprise Administration REST API worked incorrectly when an integration matching the OAuth Application ID already existed.

Configuration errors that halt a config apply run are now output to the terminal in addition to the configuration log.

When attempting to cache a value larger than the maximum allowed in Memcached, an error was raised however the key was not reported.

The CodeQL starter workflow no longer errors even if the default token permissions for GitHub Actions are not used.

If GitHub Advanced Security features are enabled on your instance, the performance of background jobs has improved when processing batches for repository contributions.

MEDIUM: A path traversal vulnerability was identified in GitHub Enterprise Server Management Console that allowed the bypass of CSRF protections. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23732.

MEDIUM: An integer overflow vulnerability was identified in the 1.x branch and the 2.x branch of yajil which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. This vulnerability was reported internally and has been assigned CVE-2022-24795.

Support bundles could include sensitive files if GitHub Actions was enabled.

Packages have been updated to the latest security versions.

Minio processes would have high CPU usage if an old configuration option was present after upgrading GitHub Enterprise Server.

The options to enable TLS 1.0 and TLS 1.1 in the Privacy settings of the Management Console were shown, although removal of those protocol versions occurred in an earlier release.

In a HA environment, configuring MSSQL replication could require additional manual steps after enabling GitHub Actions for the first time.

A subset of internal configuration files are more reliably updated after a hotpatch.

The ghe-run-migrations script would sometimes fail to generate temporary certificate names correctly.

In a cluster environment, Git LFS operations could fail with failed internal API calls that crossed multiple web nodes.

Pre-receive hooks that used gpg --import timed out due to insufficient syscall privileges.

In some cluster topologies, webhook delivery information was not available.

In HA configurations, tearing down a replica would fail if GitHub Actions had previously been enabled.

Elasticsearch health checks would not allow a yellow cluster status when running migrations.

Organizations created as a result of a user transforming their user account into an organization were not added to the global enterprise account.

When using ghe-migrator or exporting from GitHub.com, a long-running export would fail when data was deleted mid-export.

The GitHub Actions deployment graph would display an error when rendering a pending job.

Links to inaccessible pages were removed.

Navigating away from a comparison of two commits in the web UI would have the diff persist in other pages.

Adding a team as a reviewer to a pull request would sometimes show the incorrect number of members on that team.

The Remove team membership for a user API endpoint would respond with an error when attempting to remove a member managed externally by a SCIM group.

A large number of dormant users could cause a GitHub Connect configuration to fail.

The "F