Skip to main content
� 

� 

This version of GitHub Enterprise was discontinued on 2023-01-18. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

Enterprise Server 3.3 release notes

Enterprise Server 3.3.19

Download GitHub Enterprise Server 3.3.19

January 17, 2023

📣 This is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.18

Download GitHub Enterprise Server 3.3.18

January 12, 2023

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Security fixes

  • Sanitize additional secrets in support bundles and the configuration log.

  • Packages have been updated to the latest security versions.

    Bug fixes

  • The metrics Active workers and Queued requests for github (renamed from metadata), gitauth, and unicorn container services werent correctly read from collectd and displayed in the Management Console.

    Changes

  • The performance of configuration runs started with ghe-config-apply has been improved.

  • When upgrading an instance with a new root partition, running the ghe-upgrade command with the -t/--target option ensures the preflight check for the minimum disk storage size is executed against the target partition.

  • When exporting account data, backing up a repository, or performing a migration, the link to a repository archive now expires after 1 hour. Previously the archive link expired after 5 minutes.

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.17

Download GitHub Enterprise Server 3.3.17

December 13, 2022

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Security fixes

  • HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-46256.

  • HIGH: An incorrect authorization vulnerability allowed a scoped user-to-server token to escalate to full admin access for a repository. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.0. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23741.

    Bug fixes

  • Installation of GitHub Enterprise Server on the VMware ESXi hypervisor failed due to the generation of an OVA file with an invalid capacity value.

  • When users performed an operation using the API, GitHub Enterprise Server enforced repository size quotas even when disabled globally.

  • A debug-level message appeared in a system log, which could consume space rapidly on the instance's root storage volume.

  • On instances where the dependency graph is enabled, upgrades could sometimes fail due to a slow-running migration of dependency graph data.

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.16

Download GitHub Enterprise Server 3.3.16

November 22, 2022

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Security fixes

  • MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.

  • MEDIUM: Scoped user-to-server tokens from GitHub Apps could bypass authorization checks in GraphQL API requests when accessing non-repository resources. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-23739.

  • MEDIUM: Pull request preview links did not properly sanitize URLs, allowing a malicious user to embed dangerous links in the instances web UI. This vulnerability was reported via the GitHub Bug Bounty program.

  • MEDIUM: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify GitHub Actions workflow files without a workflow scope. The "Create or Update file contents API" should enforce workflow scope. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-46258.

    Bug fixes

  • Setting the maintenance mode with an IP Exception List would not persist across upgrades.

  • After configuration of Dependabot and alert digest emails, the instance would send digest emails to suspended users.

  • If a user configured a pre-receive hook for multiple repositories, the instances Hooks page would not always display the correct status for the hook.

  • Zombie processes no longer accumulate in the gitrpcd container.

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.15

Download GitHub Enterprise Server 3.3.15

October 25, 2022

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Security fixes

  • HIGH: Updated dependencies for the Management Console to the latest patch versions, which addresses security vulnerabilities including CVE-2022-30123 and CVE-2022-29181.

  • HIGH: Added checks to address an improper cache key vulnerability that allowed an unauthorized actor to access private repository files through a public repository. This vulnerability has been assigned CVE-2022-23738.

  • MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.

  • MEDIUM: Updated GitHub Actions runners to fix a bug that allowed environment variables in GitHub Actions jobs to escape the context of the variable and modify the invocation of docker commands directly. For more information, see the Actions Runner security advisory.

  • MEDIUM: Updated Redis to 5.0.14 to address CVE-2021-32672 and CVE-2021-32762.

  • MEDIUM: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23737.

  • LOW: Due to a CSRF vulnerability, a GET request to the instance's site/toggle_site_admin_and_employee_status endpoint could toggle a user's site administrator status unknowingly.

  • Packages have been updated to the latest security versions.

    Bug fixes

  • After a site administrator made a change that triggered a configuration run, such as disabling GitHub Actions, validation of services would sometimes fail with the message WARNING: Validation encountered a problem.

  • After a site administrator installed a hotpatch containing changes to web interface assets such as JavaScript files or images, the instance did not serve the new assets.

  • Deleted assets and assets scheduled to be purged within a repository, such as LFS files, took too long to to be cleaned up.

  • If a user installed a GitHub App for the user account and then converted the account into an organization, the app was not granted organization permissions.

    Changes

  • To ensure that site administrators can successfully complete an upgrade, the instance will now execute a preflight check to ensure that the virtual machine meets minimum hardware requirements. The check also verifies Elasticsearch's health. You can review the current requirements for CPU, memory, and storage for GitHub Enterprise Server in the "Minimum requirements" section within each article in "Setting up a GitHub Enterprise Server instance."

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.14

Download GitHub Enterprise Server 3.3.14

September 21, 2022

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Security fixes

  • HIGH: A GitHub App could use a scoped user-to-server token to bypass user authorization logic and escalate privileges.

  • MEDIUM: The use of a Unicode right-to-left override character in the list of accessible files for a GitHub App could obscure additional files that the app could access.

  • Packages have been updated to the latest security versions.

    Bug fixes

  • Installation of a TLS certificate failed when the certificate's subject string included UTF-8 characters.

  • Configuration runs could fail when retry-limit or retry-sleep-duration were manually set by an administrator using ghe-config.

  • In some cases, the Management Console's monitor dashboard would not load correctly.

  • Removed a non-functional link for exporting Management Console monitor graphs as a PNG image.

  • When sending a support bundle to GitHub Enterprise Support using ghe-support-upload, the -t option would not successfully associate the uploaded bundle with the specified ticket.

  • A link back to the security settings for the instance's enterprise account could render an incorrect view.

  • Git clones or fetches over SSH could experience data corruption for transfers over 1GB in size.

  • After a user deleted or restored packages from the web interface, counts for packages could render incorrectly.

  • After successful configuration of Dependabot and alert digest emails, the instance would not send digest emails.

  • Manually disabled GitHub Actions workflows in a repository were re-enabled if the repository received a push containing more than 2048 commits, or if the repository's default branch changed.

  • When using a VPC endpoint URL as an AWS S3 URL for GitHub Packages, publication and installation of packages failed.

    Known issues

  • After upgrading to GitHub Enterprise Server 3.3, GitHub Actions may fail to start automatically. To resolve this issue, connect to the appliance via SSH and run the ghe-actions-start command.

  • On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.

  • Custom firewall rules are removed during the upgrade process.

  • Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.

  • Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.

  • When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.

  • The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.

  • Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.

  • GitHub Actions storage settings cannot be validated and saved in the Management Console when "Force Path Style" is selected, and must instead be configured with the ghe-actions-precheck command line utility.

  • In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

    To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

  • Hotpatch upgrades to GitHub Enterprise Server may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:

    echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections

    If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.3.13

Download GitHub Enterprise Server 3.3.13

August 30, 2022

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

    Bug fixes

  • After unlocking a repository for temporary access, a site administrator was unable to manage settings for security products in the repository.

  • Duplicate administrative SSH keys could appear in both the Management Console and the /home/admin/.ssh/authorized_keys file.

  • In some cases, running ghe-cluster-config-apply could replicate an empty configuration to existing nodes in a cluster.

  • In some cases, configuration runs started with ghe-config-apply did not complete, or returned a Container count mismatch error.

  • After updating a self-signed TLS certificate on a GitHub Enterprise Server instance, UI elements on some pages in the web interface did not appear.

  • In some cases, background tasks could stall due to a library that was used concurrently despite not being thread-safe.

    Changes

  • Generation of support bundles is faster as a result of parallelized log sanitization. For more information about support bundles, see "Providing data to GitHub Support."

  • The enterprise audit log now includes more user-generated events, such as project.create.