Release notes - GitHub Enterprise Server 3.4 Docs

Enterprise Server 3.4.18

Download GitHub Enterprise Server 3.4.18

March 23, 2023

📣 This is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.4.18: Security fixes

HIGH: Addressed an improper authentication vulnerability that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-23761. [Updated: 2023-04-07]
MEDIUM: Addressed an incorrect comparison vulnerability that allowed commit smuggling by displaying an incorrect diff. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-23762. [Updated: 2023-04-07]

3.4.18: Bug fixes

In the Management Console's monitor dashboard, the Cached Requests and Served Requests graphs, which are retrieved by the git fetch catching command, did not display metrics for the instance.
After a site administrator exempted the @github-actions[bot] user from rate limiting by using the ghe-config app.github.rate-limiting-exempt-users "github-actions[bot]" command, running ghe-config-check caused a Validation is-valid-characterset failed warning to appear.
GitHub Actions (actions) and Microsoft SQL (mssql) did not appear in the list of processes within the instances monitor dashboard.
On an instance in a high availability configuration, if an administrator tore down replication from a replica node using ghe-repl-teardown immediately after running ghe-repl-setup, but before ghe-repl-start, an error indicated that the script cannot launch /usr/local/bin/ghe-single-config-apply - run is locked. ghe-repl-teardown now displays an informational alert and continues the teardown.
On an instance in a cluster configuration, when a site administrator set maintenance mode using ghe-maintenance -s, a Permission denied error appeared when the utility tried to access /data/user/common/cluster.conf.
When a site administrator used ghe-migrator to migrate data to GitHub Enterprise Server, in some cases, nested team relationships would not persist after teams were imported.
GitHub Enterprise Server published distribution metrics that cannot be processed by collectd. The metrics included pre_receive.lfsintegrity.dist.referenced_oids, pre_receive.lfsintegrity.dist.unknown_oids, and git.hooks.runtime.

3.4.18: Changes

After an enterprise owner enables Dependabot updates, the instance creates the initial set of updates faster.
On an instance in a cluster configuration, when a site administrator sets maintenance mode on a single cluster node using ghe-maintenance -s, the utility warns the administrator to use ghe-cluster-maintenance -s to set maintenance mode on all of the clusters nodes. For more information, see "Enabling and scheduling maintenance mode."
When a site administrator configures an outbound web proxy server for GitHub Enterprise Server, the instance now validates top-level domains (TLDs) excluded from the proxy configuration. By default, you can exclude public TLDs that the IANA specifies. Site administrators can specify a list of unregistered TLDs to exclude using ghe-config. The . prefix is required for any public TLDs. For example, .example.com is valid, but example.com is invalid. For more information, see "Configuring an outbound web proxy server."
The default path for output from ghe-saml-mapping-csv -d is /data/user/tmp instead of /tmp. For more information, see "Command-line utilities."

3.4.18: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Hotpatch upgrades to GitHub Enterprise Server 3.4.9 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:
```
echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections
```
If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.

Enterprise Server 3.4.17

Download GitHub Enterprise Server 3.4.17

March 02, 2023

📣 This is not the latest patch release of this release series, and this is not the latest release of Enterprise Server. Please use the latest release for the latest security, performance, and bug fixes.

3.4.17: Security fixes

HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-23760. [Updated: 2023-03-10]

3.4.17: Bug fixes

When viewing a list of open sessions for the devices logged into a user account, the GitHub Enterprise Server web UI could display an incorrect location.
In the rare case when primary shards for Elasticsearch were located on a replica node, the ghe-repl-stop command would fail with ERROR: Running migrations.

3.4.17: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
Hotpatch upgrades to GitHub Enterprise Server 3.4.9 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:
```
echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections
```
If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.4.16

Download GitHub Enterprise Server 3.4.16

February 16, 2023

3.4.16: Security fixes

HIGH: Updated Git to include fixes from 2.39.2, which address CVE-2023-22490 and CVE-2023-23946.
Packages have been updated to the latest security versions.

3.4.16: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
Hotpatch upgrades to GitHub Enterprise Server 3.4.9 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:
```
echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections
```
If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]

Enterprise Server 3.4.15

Download GitHub Enterprise Server 3.4.15

February 02, 2023

3.4.15: Security fixes

MEDIUM: A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner due to improper sanitization of null bytes. To exploit this vulnerability, an attacker would need existing permission to control the value of environment variables for use with GitHub Actions. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2023-22381.
Packages have been updated to the latest security versions.

3.4.15: Bug fixes

During the validation phase of a configuration run, a No such object error may have occurred for the Notebook and Viewscreen services.
When enabling automatic TLS certificate management with Let's Encrypt, the process could fail with the error The certificate is not signed by a trusted certificate authority (CA) or the certificate chain in missing intermediate CA signing certificates.

3.4.15: Changes

When a timeout occurs during diff generation, such as when a commit displays an error that the diff is taking too long to generate, the push webhook event will deliver empty diff information. Previously, the push webhook event would fail to be delivered.

3.4.15: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.14

Download GitHub Enterprise Server 3.4.14

January 17, 2023

3.4.14: Security fixes

HIGH: Updated Git to include fixes from 2.39.1, which address CVE-2022-41903 and CVE-2022-23521.

3.4.14: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.13

Download GitHub Enterprise Server 3.4.13

January 12, 2023

3.4.13: Security fixes

Sanitize additional secrets in support bundles and the configuration log.
Dependencies for the CodeQL action have been updated to the latest security versions.
Packages have been updated to the latest security versions.

3.4.13: Bug fixes

The metrics Active workers and Queued requests for github (renamed from metadata), gitauth, and unicorn container services werent correctly read from collectd and displayed in the Management Console.
Repositories locked for migration would allow files to be edited in the web UI.
The git-janitorcommand was unable to fix outdated multi-pack-index.lock files, resulting in the repository failing maintenance.

3.4.13: Changes

The ghe-support-bundle and ghe-cluster-support-bundle commands were updated to include the -p/--period flag to generate a time constrained support bundle. The duration can be specified in days and hours, for example: -p '2 hours', -p '1 day', -p '2 days 5 hours'.
The performance of configuration runs started with ghe-config-apply has been improved.
When upgrading an instance with a new root partition, running the ghe-upgrade command with the -t/--target option ensures the preflight check for the minimum disk storage size is executed against the target partition.
When exporting account data, backing up a repository, or performing a migration, the link to a repository archive now expires after 1 hour. Previously the archive link expired after 5 minutes.

3.4.13: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.12

Download GitHub Enterprise Server 3.4.12

December 13, 2022

3.4.12: Security fixes

HIGH: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-46256.
HIGH: An incorrect authorization vulnerability allowed a scoped user-to-server token to escalate to full admin access for a repository. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.0. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23741.
MEDIUM: An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploit this vulnerability, an attacker would need access to the GHES instance, permissions to modify GitHub Actions runner groups, and successfully guess the obfuscated ID of private repositories. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-46257.

3.4.12: Bug fixes

When a site administrator ran the ghe-repl-sync-ca-certificates command from an instances primary node via the administrative shell (SSH), the command only replicated CA certificates from the instances primary node to a single replica node. The command did not replicate the certificates to all available replica nodes.
Installation of GitHub Enterprise Server on the VMware ESXi hypervisor failed due to the generation of an OVA file with an invalid capacity value.
When users performed an operation using the API, GitHub Enterprise Server enforced repository size quotas even when disabled globally.
The member webhook event did not include the from and to field values for the permission field as part of the changes field.
After a user's account was deleted from the instance, image attachments that the user uploaded in comments were no longer visible in the web interface.
A debug-level message appeared in a system log, which could consume space rapidly on the instance's root storage volume.

3.4.12: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.11

Download GitHub Enterprise Server 3.4.11

November 22, 2022

3.4.11: Security fixes

MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.
MEDIUM: Scoped user-to-server tokens from GitHub Apps could bypass authorization checks in GraphQL API requests when accessing non-repository resources. This vulnerability was reported via the GitHub Bug Bounty Program and has been assigned CVE-2022-23739.
MEDIUM: Pull request preview links did not properly sanitize URLs, allowing a malicious user to embed dangerous links in the instances web UI. This vulnerability was reported via the GitHub Bug Bounty program.
MEDIUM: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify GitHub Actions workflow files without a workflow scope. The "Repository contents" should enforce workflow scope. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-46258.

3.4.11: Bug fixes

If GitHub Actions was configured with S3 blob storage for the instance, content like logs and artifacts from deleted or expired workflow runs would remain in blob storage indefinitely. The instance will delete this content automatically the next time a regular background cleanup job runs.
Setting the maintenance mode with an IP Exception List would not persist across upgrades.
GitHub Pages builds could time out on instances in AWS that are configured for high availability.
After configuration of Dependabot and alert digest emails, the instance would send digest emails to suspended users.
If a user configured a pre-receive hook for multiple repositories, the instances Hooks page would not always display the correct status for the hook.
In some cases, users could not merge a pull request due to unexpected status checks.
After running migrations for the GitHub Enterprise Importer on an instance configured for high availability, replication of migration storage assets would not catch up.
Zombie processes no longer accumulate in the gitrpcd container.

3.4.11: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.10

Download GitHub Enterprise Server 3.4.10

October 25, 2022

3.4.10: Security fixes

HIGH: Updated dependencies for the Management Console to the latest patch versions, which addresses security vulnerabilities including CVE-2022-30123 and CVE-2022-29181.
HIGH: Added checks to address an improper cache key vulnerability that allowed an unauthorized actor to access private repository files through a public repository. This vulnerability has been assigned CVE-2022-23738.
MEDIUM: Updated CommonMarker to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned CVE-2022-39209.
MEDIUM: Updated Redis to 5.0.14 to address CVE-2021-32672 and CVE-2021-32762.
MEDIUM: Updated GitHub Actions runners to fix a bug that allowed environment variables in GitHub Actions jobs to escape the context of the variable and modify the invocation of docker commands directly. For more information, see the Actions Runner security advisory.
MEDIUM: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23737.
LOW: Due to a CSRF vulnerability, a GET request to the instance's site/toggle_site_admin_and_employee_status endpoint could toggle a user's site administrator status unknowingly.
Packages have been updated to the latest security versions.

3.4.10: Bug fixes

After a site administrator made a change that triggered a configuration run, such as disabling GitHub Actions, validation of services would sometimes fail with the message WARNING: Validation encountered a problem.
After a site administrator installed a hotpatch containing changes to web interface assets such as JavaScript files or images, the instance did not serve the new assets.
When a user accessed a renamed repository using Git, the hostname in the Git output incorrectly indicated GitHub.com instead of the instance's hostname.
Deleted assets and assets scheduled to be purged within a repository, such as LFS files, took too long to to be cleaned up.
If a user installed a GitHub App for the user account and then converted the account into an organization, the app was not granted organization permissions.

3.4.10: Changes

To ensure that site administrators can successfully complete an upgrade, the instance will now execute a preflight check to ensure that the virtual machine meets minimum hardware requirements. The check also verifies Elasticsearch's health. You can review the current requirements for CPU, memory, and storage for GitHub Enterprise Server in the "Minimum requirements" section within each article in "Setting up a GitHub Enterprise Server instance."

3.4.10: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]

Enterprise Server 3.4.9

Download GitHub Enterprise Server 3.4.9

September 21, 2022

3.4.9: Features

Repository archives for migrations now include an is_archived field.

3.4.9: Security fixes

HIGH: A GitHub App could use a scoped user-to-server token to bypass user authorization logic and escalate privileges.
MEDIUM: The use of a Unicode right-to-left override character in the list of accessible files for a GitHub App could obscure additional files that the app could access.
LOW: Granting a user the ability to bypass branch protections no longer allows the user to bypass the requirement for signature verification.
Packages have been updated to the latest security versions.

3.4.9: Bug fixes

Installation of a TLS certificate failed when the certificate's subject string included UTF-8 characters.
Configuration runs could fail when retry-limit or retry-sleep-duration were manually set by an administrator using ghe-config.
In some cases, the Management Console's monitor dashboard would not load correctly.
Removed a non-functional link for exporting Management Console monitor graphs as a PNG image.
The ghe-find-insecure-git-operations command did not return all insecure Git operations after each invocation.
In rare cases, an upgrade from GitHub Enterprise Server 3.3 to 3.4 would incorrectly modify how data is stored, resulting in failures during future upgrades. When upgrading directly to this release from 3.3, the failure will not occur.
When sending a support bundle to GitHub Enterprise Support using ghe-support-upload, the -t option would not successfully associate the uploaded bundle with the specified ticket.
A link back to the security settings for the instance's enterprise account could render an incorrect view.
Git clones or fetches over SSH could experience data corruption for transfers over 1GB in size.
After a user deleted or restored packages from the web interface, counts for packages could render incorrectly.
After successful configuration of Dependabot and alert digest emails, the instance would not send digest emails.
After upgrading to GitHub Enterprise Server 3.4, releases would appear to be missing from repositories. This occurred when the required Elasticsearch index migrations had not successfully completed. The releases UI now indicates if it is waiting for the Elasticsearch index migrations to complete, and links to documentation on how to observe status and immediately complete the migration.
Manually disabled GitHub Actions workflows in a repository were re-enabled if the repository received a push containing more than 2048 commits, or if the repository's default branch changed.
If branch protections were enabled, the GITHUB_REF_PROTECTED environment variable and github.ref_protected contexts for GitHub Actions workflow runs were incorrectly set as false.
When using a VPC endpoint URL as an AWS S3 URL for GitHub Packages, publication and installation of packages failed.
When adding a member to an organization, an erroneous SAML SSO trial invitation appeared.

3.4.9: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
Hotpatch upgrades to GitHub Enterprise Server 3.4.9 may fail. Upgrades with the full .pkg are unaffected. If the upgrade fails for your instance, workaround this issue by connecting to the administrative shell (ssh) and running the following non-interactive command:
```
echo "grub-pc grub-pc/install_devices_empty boolean true" | sudo debconf-set-selections
```
If you're unable to upgrade, or if you need further assistance, contact GitHub Support. For more information, see "Creating a support ticket." [Updated: 2022-10-14]
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]

Enterprise Server 3.4.8

Download GitHub Enterprise Server 3.4.8

August 30, 2022

3.4.8: Bug fixes

After unlocking a repository for temporary access, a site administrator was unable to manage settings for security products in the repository.
Duplicate administrative SSH keys could appear in both the Management Console and the /home/admin/.ssh/authorized_keys file.
The site admin page for individual users at http(s)://HOSTNAME/stafftools/users/USERNAME/admin contained functionality not intended for GitHub Enterprise Server.
In some cases, running ghe-cluster-config-apply could replicate an empty configuration to existing nodes in a cluster.
In some cases, configuration runs started with ghe-config-apply did not complete, or returned a Container count mismatch error.
After updating a self-signed TLS certificate on a GitHub Enterprise Server instance, UI elements on some pages in the web interface did not appear.
In some cases, background tasks could stall due to a library that was used concurrently despite not being thread-safe.

3.4.8: Changes

Generation of support bundles is faster as a result of parallelized log sanitization. For more information about support bundles, see "Providing data to GitHub Support."
APIs that contain the organization or org route now accept either the organization's slug or ID. Previously, the APIs only accepted slugs, which caused Link headers for GitHub Advanced Security endpoints to be inaccessible. For more information, see "Organizations" in the REST API documentation.
The enterprise audit log now includes more user-generated events, such as project.create. The REST API also returns additional user-generated events, such as repo.create. For more information, see "Accessing the audit log for your enterprise" and "Using the audit log API for your enterprise."

3.4.8: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]

Enterprise Server 3.4.7

Download GitHub Enterprise Server 3.4.7

August 11, 2022

3.4.7: Security fixes

CRITICAL: GitHub Enterprise Server's Elasticsearch container used a version of OpenJDK 8 that was vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. The vulnerability is tracked as CVE-2022-34169.
HIGH: Previously installed apps on user accounts were automatically granted permission to access an organization on scoped access tokens after the user account was transformed into an organization account. This vulnerability was reported via the GitHub Bug Bounty program.

3.4.7: Bug fixes

In some cases, GitHub Enterprise Server instances on AWS that used the r4.4xlarge instance type would fail to boot.
When calculating committers for GitHub Advanced Security, it was not possible to specify individual repositories. For more information, see "Site admin dashboard."
When a custom dormancy threshold was set for the instance, suspending all dormant users did not reliably respect the threshold. For more information about dormancy, see "Managing dormant users."

3.4.7: Changes

pre_receive_hook.rejected_push events were not displayed in the enterprise audit log.
Both migration archives for repositories and archive exports for user accounts include release reactions.

3.4.7: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]

Enterprise Server 3.4.6

Download GitHub Enterprise Server 3.4.6

July 21, 2022

3.4.6: Security fixes

MEDIUM: Prevents an attack where a server-side request forgery (SSRF) could potentially force the Subversion (SVN) bridge to execute remote code by injecting arbitrary data into Memcached.
MEDIUM: Prevents an attacker from executing Javascript code by exploiting a cross-site scripting (XSS) vulnerability in dropdown UI elements within the GitHub Enterprise Server web interface.
Updates Grafana to version 7.5.16, which addresses various security vulnerabilities including CVE-2020-13379 and CVE-2022-21702.
Packages have been updated to the latest security versions.
MEDIUM: A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23733. [Updated: 2022-07-31]
MEDIUM: A vulnerability involving deserialization of untrusted data was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the Subversion (SVN) bridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2022-23734.

3.4.6: Bug fixes

In some cases, the collectd daemon could consume excess memory.
In some cases, backups of rotated log files could accumulate and consume excess storage.
After an upgrade to a new feature release and subsequent configuration run, Elasticsearch could log excessive exceptions while rebuilding indices.
In some cases where a protected branch required more than one approving review, a pull request could be merged with fewer than the required number of approving reviews.
On instances using LDAP authentication, the authentication prompt for sudo mode incorrectly placed the cursor within the password field by default when text fields for both a username and password were visible.
In some cases, scheduled GitHub Actions workflows could become disabled.
The Billing API's "Billing" endpoint now returns Link headers to provide information about pagination.
The Billing API's "Billing" endpoint now returns the correct number of total committers.

3.4.6: Changes

The ghe-set-password command-line utility starts required services automatically when the instance is booted in recovery mode.
Metrics for aqueduct background processes are gathered for Collectd forwarding and display in the Management Console.
The location of the database migration and configuration run log, /data/user/common/ghe-config.log, is now displayed on the page that details a migration in progress.

3.4.6: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration. [Updated: 2022-06-17]
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]

Enterprise Server 3.4.5

Download GitHub Enterprise Server 3.4.5

June 28, 2022

3.4.5: Security fixes

MEDIUM: Prevents an attack where an org query string parameter can be specified for a GitHub Enterprise Server URL that then gives access to another organization's active committers.
MEDIUM: Ensures that github.company.com and github-company.com are not evaluated by internal services as identical hostnames, preventing a potential server-side security forgery (SSRF) attack.
LOW: An attacker could access the Management Console with a path traversal attack via HTTP even if external firewall rules blocked HTTP access.
Packages have been updated to the latest security versions.

3.4.5: Bug fixes

Files inside an artifact archive were unable to be opened after decompression due to restrictive permissions.
Redis timeouts no longer halt database migrations while running ghe-config-apply.
Background job processors would get stuck in a partially shut-down state, resulting in certain kinds of background jobs (like code scanning) appearing stuck.
In some cases, site administrators were not automatically added as enterprise owners.
A rendering issue could affect the dropdown list for filtering secret scanning alerts in a repository.

3.4.5: Changes

Improved the performance of Dependabot version updates after first enabled.
The GitHub Pages build and synchronization timeouts are now configurable in the Management Console.
Creating or updating check runs or check suites could return 500 Internal Server Error if the value for certain fields, like the name, was too long.
When deploying cache-server nodes, it is now mandatory to describe the datacenter topology (using the --datacenter argument) for every node in the system. This requirement prevents situations where leaving datacenter membership set to "default" leads to workloads being inappropriately balanced across multiple datacenters.

3.4.5: Known issues

On a freshly set up GitHub Enterprise Server instance without any users, an attacker could create the first admin user.
Custom firewall rules are removed during the upgrade process.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
The GitHub Packages npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
After registering a self-hosted runner with the --ephemeral parameter on more than one level (for example, both enterprise and organization), the runner may get stuck in an idle state and require re-registration.
After upgrading to GitHub Enterprise Server 3.4, releases may appear to be missing from repositories. This can occur when the required Elasticsearch index migrations have not successfully completed.
In some cases, GitHub Advanced Security customers who upgrade to GitHub Enterprise Server 3.5 or later may notice that alerts from secret scanning are missing in the web UI and REST API. To ensure the alerts remain visible, do not skip 3.4 when you upgrade from an earlier release to 3.5 or later. A fix is available in the 3.5.5 and 3.6.1 patch releases.

To plan an upgrade through 3.4, see the Upgrade assistant. [Updated: 2022-09-01]
GitHub Pages builds may time out on instances in AWS that are configured for high availability. [Updated: 2022-11-28]

Enterprise Server 3.4.4

Download GitHub Enterprise Server 3.4.4

June 09, 2022

3.4.4: Security fixes

Packages have been updated to the latest security versions.

3.4.4: Bug fixes

An internal script to validate hostnames in the GitHub Enterprise Server configuration file would return an error if the hostname string started with a "." (period character).
In HA configurations where the primary node's hostname was longer than 60 characters, MySQL would fail to be configured.
When GitHub Actions was enabled but TLS was disabled on GitHub Enterprise Server 3.4.1 and later, applying a configuration update would fail.
The --gateway argument was added to the ghe-setup-network command, to allow passing the gateway address when configuring network settings using the command line.
The GitHub Advanced Security billing API endpoints were not enabled and accessible.
Image attachments that were deleted would return a 500 Internal Server Error instead of a 404 Not Found error.
In environments configured with a repository cache server, the ghe-repl-status command incorrectly showed gists as being under-replicated.
The "Get a commit" and "Compare two commits" endpoints in the Commit API would return a 500 error if a file path in the diff contained an encoded and escaped unicode character.
The calculation of

Enterprise Server 3.4 release notes