fix yaml data linting errors (#49571)
Co-authored-by: Peter Bengtsson <peterbe@github.com> Co-authored-by: Evan Bonsignori <ebonsignori@github.com>
This commit is contained in:
Rachael Sewell
@@ -5,8 +5,7 @@
|
||||
- term: access token
|
||||
description: >-
|
||||
A token that is used in place of a password when performing Git operations
|
||||
over HTTPS with Git on the command line or the API. Also called a personal
|
||||
access token.
|
||||
over HTTPS with Git on the command line or the API. Also called a {% data variables.product.pat_generic %}.
|
||||
- term: API preview
|
||||
description: >-
|
||||
A way to try out new APIs and changes to existing API methods before they
|
||||
@@ -96,7 +95,7 @@
|
||||
- term: clean
|
||||
description: >-
|
||||
A working tree is clean if it corresponds to the revision referenced by the
|
||||
current HEAD. Also see ["dirty"](#dirty).
|
||||
current HEAD. Also see "[dirty](#dirty)".
|
||||
- term: clone
|
||||
description: >-
|
||||
A clone is a copy of a repository that lives on your computer instead of on
|
||||
@@ -554,7 +553,7 @@
|
||||
Pull refers to when you are fetching in changes and merging them. For
|
||||
instance, if someone has edited the remote file you're both working on,
|
||||
you'll want to pull in those changes to your local copy so that it's up to
|
||||
date. See also ["fetch"](#fetch).
|
||||
date. See also "[fetch](#fetch)".
|
||||
- term: pull access
|
||||
description: A synonym for read access.
|
||||
- term: pull request
|
||||
|
||||
@@ -34,10 +34,10 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/2998
|
||||
- |
|
||||
To help users access resources more securely, fine-grained personal access tokens are available in public beta. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens)."
|
||||
- Users can create fine-grained personal access tokens with access to their personal repositories or, if permitted, organization-owned repositories.
|
||||
- Organization and enterprise owners can enable or disable the use of fine-grained personal access tokens in organization-owned repositories, and can use the REST API or GraphQL API to manage tokens in their organizations.
|
||||
- Users creating fine-grained tokens for an organization can add the `pre-receive hooks` permission to allow managing pre-receive hooks. For more information, see "[AUTOTITLE](/admin/policies/enforcing-policy-with-pre-receive-hooks/managing-pre-receive-hooks-on-the-github-enterprise-server-appliance)."
|
||||
To help users access resources more securely, {% data variables.product.pat_v2_plural %} are available in public beta. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens)."
|
||||
- Users can create {% data variables.product.pat_v2_plural %} with access to their personal repositories or, if permitted, organization-owned repositories.
|
||||
- Organization and enterprise owners can enable or disable the use of {% data variables.product.pat_v2_plural %} in organization-owned repositories, and can use the REST API or GraphQL API to manage tokens in their organizations.
|
||||
- Users creating {% data variables.product.pat_v2_plural %} for an organization can add the `pre-receive hooks` permission to allow managing pre-receive hooks. For more information, see "[AUTOTITLE](/admin/policies/enforcing-policy-with-pre-receive-hooks/managing-pre-receive-hooks-on-the-github-enterprise-server-appliance)."
|
||||
|
||||
- heading: GitHub Advanced Security
|
||||
notes:
|
||||
@@ -111,7 +111,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3112
|
||||
- |
|
||||
Users can find curated security advisories for the Swift ecosystem in the GitHub Advisory Database. For more information, see "[AUTOTITLE](/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database)." [Updated: 2023-08-24]
|
||||
|
||||
|
||||
- heading: GitHub Actions
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/3136
|
||||
@@ -259,7 +259,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -35,15 +35,15 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/3251
|
||||
- |
|
||||
Site administrators can use the Manage GitHub Enterprise Server API to change the `site admin` password and to make changes to [management console users](https://docs.github.com/en/enterprise-server@3.10/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console#management-console-user). For more information, see "[AUTOTITLE](/rest/enterprise-admin/manage-ghes)" in the REST API documentation.
|
||||
Site administrators can use the Manage GitHub Enterprise Server API to change the `site admin` password and to make changes to [management console users](/enterprise-server@3.10/admin/configuration/administering-your-instance-from-the-management-console/managing-access-to-the-management-console#management-console-user). For more information, see "[AUTOTITLE](/rest/enterprise-admin/manage-ghes)" in the REST API documentation.
|
||||
|
||||
- heading: Authentication
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/2998
|
||||
- |
|
||||
To help users access resources more securely, fine-grained personal access tokens are available in public beta. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens)."
|
||||
- Users can create fine-grained personal access tokens with access to their personal repositories or, if permitted, organization-owned repositories.
|
||||
- Organization and enterprise owners can enable or disable the use of fine-grained personal access tokens in organization-owned repositories, and can use the REST API or GraphQL API to manage tokens in their organizations.
|
||||
To help users access resources more securely, {% data variables.product.pat_v2_plural %} are available in public beta. For more information, see "[AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens)."
|
||||
- Users can create {% data variables.product.pat_v2_plural %} with access to their personal repositories or, if permitted, organization-owned repositories.
|
||||
- Organization and enterprise owners can enable or disable the use of {% data variables.product.pat_v2_plural %} in organization-owned repositories, and can use the REST API or GraphQL API to manage tokens in their organizations.
|
||||
- Users creating fine-grained tokens for an organization can add the `pre-receive hooks` permission to allow managing pre-receive hooks. For more information, see "[AUTOTITLE](/admin/policies/enforcing-policy-with-pre-receive-hooks/managing-pre-receive-hooks-on-the-github-enterprise-server-appliance)."
|
||||
|
||||
- heading: GitHub Advanced Security
|
||||
@@ -260,7 +260,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -38,7 +38,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -17,7 +17,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -9,130 +9,130 @@ sections:
|
||||
security_fixes:
|
||||
- |
|
||||
**HIGH**: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of private mode by using a specially crafted API request. Private mode is the mechanism that enforces authentication for publicly-scoped resources. For more information, see "[AUTOTITLE](/admin/configuration/hardening-security-for-your-enterprise/enabling-private-mode)."
|
||||
|
||||
|
||||
This vulnerability would allow unauthenticated attackers to gain access to various types of resources set as public on the instance. To exploit this vulnerability, an attacker would need network access to the GitHub Enterprise Server instance configured in private mode. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-6847](https://www.cve.org/cverecord?id=CVE-2023-6847).
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
- |
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access via a race condition when an organization was converted from a user. GitHub has requested CVE ID [CVE-2023-46649](https://www.cve.org/cverecord?id=CVE-2023-46649) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file in the audit log in GitHub Enterprise Server was identified that that could allow an attacker to gain access to the Management Console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6802](https://www.cve.org/CVERecord?id=CVE-2023-6802) for this vulnerability.
|
||||
- |
|
||||
**MEDIUM**: A race condition in GitHub Enterprise Server allowed an outside collaborator to be added while a repository is being transferred. GitHub has requested CVE ID [CVE-2023-6803](https://www.cve.org/cverecord?id=CVE-2023-6803) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped personal access token. To exploit this, a workflow must have already existed in the target repository. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/cverecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped {% data variables.product.pat_generic %}. To exploit this, a workflow must have already existed in the target repository. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/cverecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be read with an improperly scoped token. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51380](https://www.cve.org/CVERecord?id=CVE-2023-51380).
|
||||
- |
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
- |
|
||||
**LOW:** To render interactive maps in an instance's web UI using Azure Maps, GitHub Enterprise Server has migrated from use of an unsecure Azure Maps API token to a more secure access token provided by role-based access control (RBAC) in Entra ID. After upgrading to this release, to re-enable interactive maps, an administrator must reconfigure authentication to Azure Maps in the Management Console. For more information, see "[AUTOTITLE](/admin/configuration/configuring-user-applications-for-your-enterprise/configuring-interactive-maps)."
|
||||
- |
|
||||
To address scenarios that could lead to denial of service, HAProxy has been upgraded to version 2.8.4.
|
||||
To address scenarios that could lead to denial of service, HAProxy has been upgraded to version 2.8.4.
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- |
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
- |
|
||||
On an instance in a high availability configuration, site administrators using the `ghe-repl-status` command-line utility may have seen a status of `UNKNOWN` for the MSSQL service.
|
||||
On an instance in a high availability configuration, site administrators using the `ghe-repl-status` command-line utility may have seen a status of `UNKNOWN` for the MSSQL service.
|
||||
- |
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, some maintenance tasks could fail due to incomplete upgrade steps during previous upgrades to new releases of GitHub Enterprise Server.
|
||||
On an instance with GitHub Actions enabled, some maintenance tasks could fail due to incomplete upgrade steps during previous upgrades to new releases of GitHub Enterprise Server.
|
||||
- |
|
||||
On an instance in a cluster configuration, site administrators using the `ghe-config-apply` utility may have seen the extraneous message "Error: Server closed the connection" in the logs for the utility.
|
||||
On an instance in a cluster configuration, site administrators using the `ghe-config-apply` utility may have seen the extraneous message "Error: Server closed the connection" in the logs for the utility.
|
||||
- |
|
||||
Some OAuth applications did not have device code flow (DCF) explicitly enabled, which prevented DCF from running correctly.
|
||||
Some OAuth applications did not have device code flow (DCF) explicitly enabled, which prevented DCF from running correctly.
|
||||
- |
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
- |
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
- |
|
||||
Support for authenticating to GitHub Enterprise Server from Visual Studio Code with a device code was unintentionally disabled.
|
||||
Support for authenticating to GitHub Enterprise Server from Visual Studio Code with a device code was unintentionally disabled.
|
||||
- |
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
- |
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
- |
|
||||
In some cases, when an administrator uploaded a custom TLS certificate, the certificate was not correctly installed on the instance.
|
||||
In some cases, when an administrator uploaded a custom TLS certificate, the certificate was not correctly installed on the instance.
|
||||
- |
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
- |
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
- |
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
- |
|
||||
Some responses from the REST API included an incorrect URL in the `link` header.
|
||||
Some responses from the REST API included an incorrect URL in the `link` header.
|
||||
- |
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
- |
|
||||
In some cases, `/stafftools/users/:login` incorrectly displayed trade screening information.
|
||||
In some cases, `/stafftools/users/:login` incorrectly displayed trade screening information.
|
||||
- |
|
||||
Deprecated `resource_activity` jobs were not processed and accumulated over time in the queue, causing possible memory issues.
|
||||
Deprecated `resource_activity` jobs were not processed and accumulated over time in the queue, causing possible memory issues.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
- |
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
- |
|
||||
On an instance with GitHub Connect and unified search enabled, users trying to view the unified search code results would get a 500 error.
|
||||
On an instance with GitHub Connect and unified search enabled, users trying to view the unified search code results would get a 500 error.
|
||||
- |
|
||||
On some instances, the user interface displayed a codespace button, even though GitHub Codespaces is not supported on GitHub Enterprise Server.
|
||||
On some instances, the user interface displayed a codespace button, even though GitHub Codespaces is not supported on GitHub Enterprise Server.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, an issue with `GH_TOKEN` sometimes prevented GitHub Pages sites from building successfully in workflows.
|
||||
On an instance with GitHub Actions enabled, an issue with `GH_TOKEN` sometimes prevented GitHub Pages sites from building successfully in workflows.
|
||||
- |
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
- |
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
- |
|
||||
The enterprise account pages on some installations rendered very slowly.
|
||||
The enterprise account pages on some installations rendered very slowly.
|
||||
- |
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
- |
|
||||
When using `ghe-migrator` to import repositories into GitHub Enterprise Server, the `conflicts` and `audit` subcommands produced an invalid CSV file due to an extra log line appended to the file.
|
||||
When using `ghe-migrator` to import repositories into GitHub Enterprise Server, the `conflicts` and `audit` subcommands produced an invalid CSV file due to an extra log line appended to the file.
|
||||
- |
|
||||
Pre-receive hook failures were not visible in the administrator audit log.
|
||||
Pre-receive hook failures were not visible in the administrator audit log.
|
||||
- |
|
||||
Running `ghe-spokesctl gov info` without any arguments caused a `panic` response.
|
||||
Running `ghe-spokesctl gov info` without any arguments caused a `panic` response.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, code scanning would report an incorrect number of files scanned on the "Tools" status page.
|
||||
On an instance with a GitHub Advanced Security license, code scanning would report an incorrect number of files scanned on the "Tools" status page.
|
||||
changes:
|
||||
- |
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
- |
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
- |
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
- |
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
- |
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
- |
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
- |
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
known_issues:
|
||||
- |
|
||||
Custom firewall rules are removed during the upgrade process.
|
||||
|
||||
@@ -10,7 +10,7 @@ sections:
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. GitHub has requested CVE ID [CVE-2024-0507](https://www.cve.org/cverecord?id=CVE-2024-0507) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](https://docs.github.com/en/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
@@ -71,8 +71,8 @@ sections:
|
||||
errata:
|
||||
- |
|
||||
These release notes previously indicated that GitHub Enterprise Server 3.10.5 contained fixes for the following issues:
|
||||
|
||||
|
||||
- An improper authentication vulnerability that affected private mode, [CVE-2023-6847](https://www.cve.org/cverecord?id=CVE-2023-6847)
|
||||
- An incorrect authorization vulnerability that affected issue comments, [CVE-2023-51380](https://www.cve.org/CVERecord?id=CVE-2023-51380)
|
||||
|
||||
|
||||
These fixes were included in GitHub Enterprise Server [3.10.4](/admin/release-notes#3.10.4-security-fixes).
|
||||
|
||||
@@ -8,7 +8,7 @@ intro: |
|
||||
sections:
|
||||
bugs:
|
||||
- |
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
- |
|
||||
During periods of high traffic, interruptions in service occurred due to insufficient resource allocations for internal components.
|
||||
- |
|
||||
|
||||
@@ -23,7 +23,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3320
|
||||
- |
|
||||
To help users discover the required permissions for calls to a REST API endpoint, GitHub Enterprise Server returns the `X-Accepted-GitHub-Permissions` header for requests to endpoints that use fine-grained permissions, including requests from GitHub Apps. For more information, see the following articles.
|
||||
|
||||
|
||||
- "[AUTOTITLE](/rest/overview/troubleshooting#insufficient-permissions-errors)"
|
||||
- "[AUTOTITLE](/rest/overview/permissions-required-for-fine-grained-personal-access-tokens)"
|
||||
- "[AUTOTITLE](/rest/overview/permissions-required-for-github-apps)
|
||||
@@ -78,7 +78,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/3110
|
||||
- |
|
||||
For instances with GitHub Connect configured, code scanning with CodeQL supports Java codebases that use [Project Lombok](https://projectlombok.org/). Previously, code scanning users were able to scan Java applications that contained Lombok code, but all the contents of files containing Lombok code were either skipped or users had to apply a workaround to prepare the applications for scanning. Lombok features will now be automatically scanned without requiring any workaround.
|
||||
For instances with GitHub Connect configured, code scanning with CodeQL supports Java codebases that use [Project Lombok](https://projectlombok.org/). Previously, code scanning users were able to scan Java applications that contained Lombok code, but all the contents of files containing Lombok code were either skipped or users had to apply a workaround to prepare the applications for scanning. Lombok features will now be automatically scanned without requiring any workaround.
|
||||
|
||||
For more information about syncing the required GitHub Actions workflow to scan Lombok code, see "[AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance#configuring-github-connect-to-sync-github-actions)."
|
||||
|
||||
@@ -125,10 +125,10 @@ sections:
|
||||
# https://github.com/github/releases/issues/3271
|
||||
- |
|
||||
Dependabot can open pull requests for Swift and Gradle dependencies.
|
||||
|
||||
|
||||
- Users can also configure scheduled updates for Swift dependencies using `dependabot.yml`.
|
||||
- If users have used the REST API for dependency submission to upload Gradle dependencies to the dependency graph and receive Dependabot alerts for those dependencies, Dependabot will try to open a pull request to resolve security updates enabled for the repository.
|
||||
|
||||
|
||||
For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)."
|
||||
|
||||
# https://github.com/github/releases/issues/3287
|
||||
@@ -154,7 +154,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3402
|
||||
- |
|
||||
Users can improve the security of deployment environments by configuring a branch protection policy to only allow specific branches to deploy to an environment. Additionally, the following security improvements apply to environments.
|
||||
|
||||
|
||||
- GitHub Enterprise Server blocks runs triggered from forks with branch names that match the protected branch's name.
|
||||
- Tags with the same name as a protected branch cannot deploy to the environments with a branch protection configuration.
|
||||
|
||||
@@ -236,7 +236,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3327
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, during analysis of Python projects with code scanning using CodeQL and an advanced setup, GitHub Enterprise Server would automatically install dependencies for the project. Due to improvements to CodeQL, GitHub Enterprise Server no longer needs to fetch these dependencies to analyze a codebase. To improve scan times for Python projects, automatic dependency installation is disabled.
|
||||
|
||||
|
||||
If you configured code scanning with CodeQL via advanced setup to disable dependency installation, GitHub recommends setting `setup-python-dependencies` to `false` for the configuration. For more information, see "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#analyzing-python-dependencies)."
|
||||
|
||||
# https://github.com/github/releases/issues/3172
|
||||
@@ -252,9 +252,9 @@ sections:
|
||||
On an instance with Dependabot enabled, the following improvements apply to the repository view for dependency graph, available from the repository's "Insights" tab.
|
||||
|
||||
- Users can search by package name from a paginated list of all dependencies.
|
||||
- Dependency licenses are displayed.
|
||||
- Dependency licenses are displayed.
|
||||
- Dependabot alerts appear for dependencies, sorted by severity, and link to the Dependabot alerts and the Dependabot update pull request where applicable.
|
||||
|
||||
|
||||
For more information about the dependency graph, see "[AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)."
|
||||
|
||||
# https://github.com/github/releases/issues/3253
|
||||
@@ -264,7 +264,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/2603
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, workflows that use Node.js 12 will log a warning. Node.js 12 has been end-of-life since [April 2022](https://github.com/nodejs/Release/#end-of-life-releases).
|
||||
|
||||
|
||||
- Workflow authors should update actions to run on Node.js 16 instead of 12. For more information, see "[AUTOTITLE](/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions)."
|
||||
- Users with workflows that use Node.js should specify Node.js 16 or later in the workflows using versioned actions. For more information, see "[AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#example-using-versioned-actions)."
|
||||
|
||||
@@ -272,13 +272,13 @@ sections:
|
||||
- |
|
||||
On an instance with GitHub Actions enabled and runners using GitHub Actions Runner 2.309.0 or later, users can no longer use `GITHUB_ENV` to set the `NODE_OPTIONS` environment variable in workflows. Workflows that set `NODE_OPTIONS` as an environment variable will now log the following error. For more information, see "[AUTOTITLE](/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable)" and the [v2.309.0 release](https://github.com/actions/runner/releases/tag/v2.309.0) in the actions/runner repository on GitHub.com.
|
||||
|
||||
```
|
||||
```shell
|
||||
Can't store NODE_OPTIONS output parameter using '$GITHUB_ENV' command.
|
||||
```
|
||||
|
||||
# https://github.com/github/releases/issues/3205
|
||||
- |
|
||||
Users can quickly take action on multiple items in a group, or the group itself, using the `•••` button in a table, board, or roadmap.
|
||||
Users can quickly take action on multiple items in a group, or the group itself, using the `•••` button in a table, board, or roadmap.
|
||||
|
||||
# https://github.com/github/releases/issues/3219
|
||||
- |
|
||||
@@ -286,7 +286,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/3262
|
||||
- |
|
||||
Users can view view the template used to create a project from a project's settings.
|
||||
Users can view view the template used to create a project from a project's settings.
|
||||
|
||||
# https://github.com/github/releases/issues/3262
|
||||
- |
|
||||
|
||||
@@ -17,7 +17,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3320
|
||||
- |
|
||||
To help users discover the required permissions for calls to a REST API endpoint, GitHub Enterprise Server returns the `X-Accepted-GitHub-Permissions` header for requests to endpoints that use fine-grained permissions, including requests from GitHub Apps. For more information, see the following articles.
|
||||
|
||||
|
||||
- "[AUTOTITLE](/rest/overview/troubleshooting#insufficient-permissions-errors)"
|
||||
- "[AUTOTITLE](/rest/overview/permissions-required-for-fine-grained-personal-access-tokens)"
|
||||
- "[AUTOTITLE](/rest/overview/permissions-required-for-github-apps)
|
||||
@@ -72,7 +72,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/3110
|
||||
- |
|
||||
For instances with GitHub Connect configured, code scanning with CodeQL supports Java codebases that use [Project Lombok](https://projectlombok.org/). Previously, code scanning users were able to scan Java applications that contained Lombok code, but all the contents of files containing Lombok code were either skipped or users had to apply a workaround to prepare the applications for scanning. Lombok features will now be automatically scanned without requiring any workaround.
|
||||
For instances with GitHub Connect configured, code scanning with CodeQL supports Java codebases that use [Project Lombok](https://projectlombok.org/). Previously, code scanning users were able to scan Java applications that contained Lombok code, but all the contents of files containing Lombok code were either skipped or users had to apply a workaround to prepare the applications for scanning. Lombok features will now be automatically scanned without requiring any workaround.
|
||||
|
||||
For more information about syncing the required GitHub Actions workflow to scan Lombok code, see "[AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance#configuring-github-connect-to-sync-github-actions)."
|
||||
|
||||
@@ -119,10 +119,10 @@ sections:
|
||||
# https://github.com/github/releases/issues/3271
|
||||
- |
|
||||
Dependabot can open pull requests for Swift and Gradle dependencies.
|
||||
|
||||
|
||||
- Users can also configure scheduled updates for Swift dependencies using `dependabot.yml`.
|
||||
- If users have used the REST API for dependency submission to upload Gradle dependencies to the dependency graph and receive Dependabot alerts for those dependencies, Dependabot will try to open a pull request to resolve security updates enabled for the repository.
|
||||
|
||||
|
||||
For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)."
|
||||
|
||||
# https://github.com/github/releases/issues/3287
|
||||
@@ -132,7 +132,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3253
|
||||
- |
|
||||
When Dependabot is first enabled, GitHub will not send notifications for all vulnerable dependencies found in the repository, only for new vulnerable dependencies ifentified after Dependabot is enabled. For more information, see "[AUTOTITLE](/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts)."
|
||||
|
||||
|
||||
- heading: Code security
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/3259
|
||||
@@ -152,7 +152,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3402
|
||||
- |
|
||||
Users can improve the security of deployment environments by configuring a branch protection policy to only allow specific branches to deploy to an environment. Additionally, the following security improvements apply to environments.
|
||||
|
||||
|
||||
- GitHub Enterprise Server blocks runs triggered from forks with branch names that match the protected branch's name.
|
||||
- Tags with the same name as a protected branch cannot deploy to the environments with a branch protection configuration.
|
||||
|
||||
@@ -238,7 +238,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3327
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, during analysis of Python projects with code scanning using CodeQL and an advanced setup, GitHub Enterprise Server would automatically install dependencies for the project. Due to improvements to CodeQL, GitHub Enterprise Server no longer needs to fetch these dependencies to analyze a codebase. To improve scan times for Python projects, automatic dependency installation is disabled.
|
||||
|
||||
|
||||
If you configured code scanning with CodeQL via advanced setup to disable dependency installation, GitHub recommends setting `setup-python-dependencies` to `false` for the configuration. For more information, see "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#analyzing-python-dependencies)."
|
||||
|
||||
# https://github.com/github/releases/issues/3172
|
||||
@@ -254,9 +254,9 @@ sections:
|
||||
On an instance with Dependabot enabled, the following improvements apply to the repository view for dependency graph, available from the repository's "Insights" tab.
|
||||
|
||||
- Users can search by package name from a paginated list of all dependencies.
|
||||
- Dependency licenses are displayed.
|
||||
- Dependency licenses are displayed.
|
||||
- Dependabot alerts appear for dependencies, sorted by severity, and link to the Dependabot alerts and the Dependabot update pull request where applicable.
|
||||
|
||||
|
||||
For more information about the dependency graph, see "[AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)."
|
||||
|
||||
# https://github.com/github/releases/issues/3253
|
||||
@@ -266,7 +266,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/2603
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, workflows that use Node.js 16 or earlier will log a warning. Node.js 16 has been end-of-life since [September 2023](https://github.com/nodejs/Release/#end-of-life-releases).
|
||||
|
||||
|
||||
- Workflow authors should update actions to run on Node.js 20. For more information, see "[AUTOTITLE](/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions)."
|
||||
- Users with workflows that use Node.js should specify Node.js 20 or later in the workflows using versioned actions. For more information, see "[AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#example-using-versioned-actions)."
|
||||
|
||||
@@ -276,13 +276,13 @@ sections:
|
||||
- |
|
||||
On an instance with GitHub Actions enabled and runners using GitHub Actions Runner 2.309.0 or later, users can no longer use `GITHUB_ENV` to set the `NODE_OPTIONS` environment variable in workflows. Workflows that set `NODE_OPTIONS` as an environment variable will now log the following error. For more information, see "[AUTOTITLE](/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable)" and the [v2.309.0 release](https://github.com/actions/runner/releases/tag/v2.309.0) in the actions/runner repository on GitHub.com.
|
||||
|
||||
```
|
||||
```shell
|
||||
Can't store NODE_OPTIONS output parameter using '$GITHUB_ENV' command.
|
||||
```
|
||||
|
||||
# https://github.com/github/releases/issues/3205
|
||||
- |
|
||||
Users can quickly take action on multiple items in a group, or the group itself, using the `•••` button in a table, board, or roadmap.
|
||||
Users can quickly take action on multiple items in a group, or the group itself, using the `•••` button in a table, board, or roadmap.
|
||||
|
||||
# https://github.com/github/releases/issues/3219
|
||||
- |
|
||||
@@ -290,7 +290,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/3262
|
||||
- |
|
||||
Users can view view the template used to create a project from a project's settings.
|
||||
Users can view view the template used to create a project from a project's settings.
|
||||
|
||||
# https://github.com/github/releases/issues/3262
|
||||
- |
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
date: '2023-12-21'
|
||||
intro: |
|
||||
{% warning %}
|
||||
|
||||
|
||||
**Warning**: Hotpatch upgrades from GitHub Enterprise Server version `3.11.0` to `3.11.1` will result in the instance losing network connectivity after a reboot. We have removed the hotpatch upgrade package for the `3.11.1` version of GitHub Enterprise Server to ensure this upgrade path is not executed accidentally. Before you upgrade, please make sure you have read the "[Known issues](#3.11.1-known-issues)" section of these release notes.
|
||||
|
||||
|
||||
{% endwarning %}
|
||||
sections:
|
||||
security_fixes:
|
||||
@@ -26,7 +26,7 @@ sections:
|
||||
- |
|
||||
**MEDIUM:** An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/CVERecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped personal access token. To exploit this, a workflow must have already existed in the target repository. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/CVERecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped {% data variables.product.pat_generic %}. To exploit this, a workflow must have already existed in the target repository. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/CVERecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
- |
|
||||
|
||||
@@ -36,4 +36,3 @@ sections:
|
||||
errata:
|
||||
- |
|
||||
"[Known issues](/admin/release-notes#3.11.2-known-issues)" incorrectly indicated that an upgrade to GitHub Enterprise Server 3.11 may fail. This issue does not impact GitHub Enterprise Server instances when upgrading to version 3.11.1 or later. [Updated: 2024-01-26]
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ sections:
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. GitHub has requested CVE ID [CVE-2024-0507](https://www.cve.org/cverecord?id=CVE-2024-0507) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](https://docs.github.com/en/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
|
||||
@@ -2,7 +2,7 @@ date: '2024-01-30'
|
||||
sections:
|
||||
bugs:
|
||||
- |
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
- |
|
||||
During periods of high traffic, interruptions in service occurred due to insufficient resource allocations for internal components.
|
||||
- |
|
||||
|
||||
@@ -76,14 +76,14 @@ sections:
|
||||
- heading: GitHub Actions
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/3227
|
||||
- |
|
||||
- |
|
||||
Users can set up organization-wide rules to enforce their CI/CD workflows, ensuring workflows pass before pull requests can be merged into target repositories. You can fine-tune your rule by selecting a specific branch, tag, or SHA, and provide maximum control over the version expected to run. To reduce risk, you can "evaluate" workflow rules to validate rules are working correctly. For more information, see "[AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-workflows-to-pass-before-merging)".
|
||||
# https://github.com/github/releases/issues/3417
|
||||
- |
|
||||
GitHub Actions developers can use GitHub Actions Importer to plan, forecast, and automate the migration of existing CI/CD pipelines from Bamboo Server, Bamboo Data Center, and Bitbucket. Developers can migrate their Bamboo and Bitbucket pipelines to GitHub Actions using the GitHub CLI or IssueOps. For more information, see "[AUTOTITLE](/actions/migrating-to-github-actions/automated-migrations/migrating-from-bitbucket-pipelines-with-github-actions-importer)" and "[AUTOTITLE](/actions/migrating-to-github-actions/automated-migrations/migrating-from-bamboo-with-github-actions-importer)".
|
||||
# https://github.com/github/releases/issues/3508
|
||||
- |
|
||||
Actions environments support defining selected tag patterns to restrict deployments. Administrators who want to have more secure and controlled deployments can specify selected tags or tag patterns on their protected environments. For more information, see "[AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-branches)".
|
||||
Actions environments support defining selected tag patterns to restrict deployments. Administrators who want to have more secure and controlled deployments can specify selected tags or tag patterns on their protected environments. For more information, see "[AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-branches)".
|
||||
|
||||
- heading: Community experience
|
||||
notes:
|
||||
@@ -98,8 +98,8 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/2930
|
||||
- |
|
||||
Project templates for organizations are generally available. Users in an organization can create a template to share a pre-configured project with other people in your organization as the base for their projects. For more information, see "[AUTOTITLE](/issues/planning-and-tracking-with-projects/managing-your-project/managing-project-templates-in-your-organization)".
|
||||
|
||||
Project templates for organizations are generally available. Users in an organization can create a template to share a pre-configured project with other people in your organization as the base for their projects. For more information, see "[AUTOTITLE](/issues/planning-and-tracking-with-projects/managing-your-project/managing-project-templates-in-your-organization)".
|
||||
|
||||
# https://github.com/github/releases/issues/3549
|
||||
- |
|
||||
Users can access Projects from from the global navigation menu. This page can be used to find projects you've recently viewed or created, regardless of the organization or where they are located. For more information, see "[AUTOTITLE](/issues/planning-and-tracking-with-projects/learning-about-projects/finding-your-projects)".
|
||||
@@ -127,7 +127,7 @@ sections:
|
||||
# https://github.com/github/releases/issues/3563
|
||||
- |
|
||||
The web interface for GitHub Enterprise Server has been redesigned to provide a more intuitive, responsive, and accessible navigation experience. Changes include:
|
||||
|
||||
|
||||
- Breadcrumbs to help users navigate the site more efficiently
|
||||
- Menus to quickly access a user's top repositories and teams
|
||||
- A more accessible navigation experience, including more consistent keyboard navigation and improvements to code search
|
||||
|
||||
@@ -50,7 +50,7 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/2665
|
||||
- |
|
||||
Enterprise and organization owners can support adherance to the principle of least privilege by granting access to audit log endpoints without providing full administrative privileges. To provide this access, personal access tokens and OAuth apps now support the `read:audit_log` scope. For more information, see "[Using the audit log API for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise)."
|
||||
Enterprise and organization owners can support adherance to the principle of least privilege by granting access to audit log endpoints without providing full administrative privileges. To provide this access, {% data variables.product.pat_generic_plural %} and OAuth apps now support the `read:audit_log` scope. For more information, see "[Using the audit log API for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise)."
|
||||
|
||||
# https://github.com/github/releases/issues/2676
|
||||
- |
|
||||
@@ -450,7 +450,7 @@ sections:
|
||||
- |
|
||||
During configuration of high availability, after you run `ghe-maintenance -s` in step 12 of [this documentation](/admin/enterprise-management/configuring-high-availability/creating-a-high-availability-replica#creating-a-high-availability-replica), the following error appears and maintenance mode is not enabled.
|
||||
|
||||
```
|
||||
```shell
|
||||
unable to access '/data/user/common/cluster.conf': Permission denied
|
||||
```
|
||||
|
||||
|
||||
@@ -44,7 +44,7 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/2665
|
||||
- |
|
||||
Enterprise and organization owners can support adherance to the principle of least privilege by granting access to audit log endpoints without providing full administrative privileges. To provide this access, personal access tokens and OAuth apps now support the `read:audit_log` scope. For more information, see "[Using the audit log API for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise)."
|
||||
Enterprise and organization owners can support adherance to the principle of least privilege by granting access to audit log endpoints without providing full administrative privileges. To provide this access, {% data variables.product.pat_generic_plural %} and OAuth apps now support the `read:audit_log` scope. For more information, see "[Using the audit log API for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise)."
|
||||
|
||||
# https://github.com/github/releases/issues/2676
|
||||
- |
|
||||
@@ -455,7 +455,7 @@ sections:
|
||||
- |
|
||||
After upgrading to GitHub Enterprise Server 3.8.0, commands run via SSH on any of the instance's nodes will not be logged in `/var/log/ssh-console-audit.log`. To resolve this issue, SSH into the affected node and run the following command.
|
||||
|
||||
```
|
||||
```shell
|
||||
source /etc/bash.bashrc
|
||||
```
|
||||
- '{% data reusables.release-notes.git-push-known-issue %} [Updated: 2023-03-17]'
|
||||
@@ -463,7 +463,7 @@ sections:
|
||||
- |
|
||||
Use of the search API may cause subsequent requests to other interfaces to fail. When this issue occurs, impacted API or web UI users will receive HTTP 5xx responses and this `NoMethodError` exception will be logged:
|
||||
|
||||
```
|
||||
```shell
|
||||
NoMethodError (undefined method `starts_with?' for [:ok, "refs/heads/main"]:Array):
|
||||
```
|
||||
- |
|
||||
|
||||
@@ -16,7 +16,7 @@ sections:
|
||||
- On an instance in a high availability configuration, if an administrator tore down replication from a replica node using `ghe-repl-teardown` immediately after running `ghe-repl-setup`, but before `ghe-repl-start`, an error indicated that the script `cannot launch /usr/local/bin/ghe-single-config-apply - run is locked`. `ghe-repl-teardown` now displays an informational alert and continues the teardown.
|
||||
- During configuration of high availability, if a site administrator interrupted the `ghe-repl-start` utility, the utility erroneously reported that replication was configured, and the instance would not perform expected clean-up operations.
|
||||
- Commands that site administrators ran via SSH on any of the instances nodes were not logged in `/var/log/ssh-console-audit.log`.
|
||||
- "On instances configured to use the private beta of SCIM for GitHub Enterprise Server, users' authentication with SSH keys and personal access tokens failed due to an erroneous requirement for authorization."
|
||||
- "On instances configured to use the private beta of SCIM for GitHub Enterprise Server, users' authentication with SSH keys and {% data variables.product.pat_generic_plural %} failed due to an erroneous requirement for authorization."
|
||||
- |
|
||||
After a user imported a repository with push protection enabled, the repository was not immediately visible in the security overview's "Security Coverage" view.
|
||||
- Responses from the `/repositories` REST API endpoint erroneously included deleted repositories.
|
||||
@@ -53,11 +53,11 @@ sections:
|
||||
- |
|
||||
{% data reusables.release-notes.ghe-cluster-config-apply-error %}
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
Use of the search API may cause subsequent requests to other interfaces to fail. When this issue occurs, impacted API or web UI users will receive HTTP 5xx responses and this `NoMethodError` exception will be logged:
|
||||
|
||||
```
|
||||
```shell
|
||||
NoMethodError (undefined method `starts_with?' for [:ok, "refs/heads/main"]:Array):
|
||||
```
|
||||
- |
|
||||
|
||||
@@ -30,7 +30,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -2,97 +2,97 @@ date: '2023-12-21'
|
||||
sections:
|
||||
security_fixes:
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
- |
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access via a race condition when an organization was converted from a user. GitHub has requested CVE ID [CVE-2023-46649](https://www.cve.org/cverecord?id=CVE-2023-46649) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file in the Audit Log in GitHub Enterprise Server was identified that that could allow an attacker to gain access to the Management Console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6802](https://www.cve.org/CVERecord?id=CVE-2023-6802) for this vulnerability.
|
||||
- |
|
||||
**MEDIUM**: A race condition in GitHub Enterprise Server allowed an outside collaborator to be added while a repository is being transferred. GitHub has requested CVE ID [CVE-2023-6803](https://www.cve.org/cverecord?id=CVE-2023-6803) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped personal access token. To exploit this, a workflow must have already existed in the target repo. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/cverecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped {% data variables.product.pat_generic %}. To exploit this, a workflow must have already existed in the target repo. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/cverecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be read with an improperly scoped token. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51380](https://www.cve.org/CVERecord?id=CVE-2023-51380).
|
||||
- |
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
- |
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
- |
|
||||
**LOW:** To render interactive maps in an instance's web UI using Azure Maps, GitHub Enterprise Server has migrated from use of an unsecure Azure Maps API token to a more secure access token provided by role-based access control (RBAC) in Entra ID. After upgrading to this release, to re-enable interactive maps, an administrator must reconfigure authentication to Azure Maps in the Management Console. For more information, see "[AUTOTITLE](/admin/configuration/configuring-user-applications-for-your-enterprise/configuring-interactive-maps)."
|
||||
- |
|
||||
To address scenarios that could lead to denial of service, HAProxy has been upgraded to version 2.8.4. [Updated 2024-01-03]
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- |
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
- |
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
- |
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
- |
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
- |
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
- |
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
- |
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
- |
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
- |
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
- |
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
- |
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
- |
|
||||
A missing executable on the PATH caused the `ghe-spokesctl ssh` command to fail.
|
||||
A missing executable on the PATH caused the `ghe-spokesctl ssh` command to fail.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
- |
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
- |
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
- |
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
changes:
|
||||
- |
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
- |
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
- |
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
- |
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
- |
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
- |
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
- |
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
- |
|
||||
As a security measure, GitHub Pages does not build sites that contain symbolic links except when using custom GitHub Actions workflows. When the page builder encounters a symbolic link, the build will fail with an error indicating that the symbolic link should be dereferenced. Custom workflows for GitHub Pages are available in GitHub Enterprise Server 3.7 and later.
|
||||
As a security measure, GitHub Pages does not build sites that contain symbolic links except when using custom GitHub Actions workflows. When the page builder encounters a symbolic link, the build will fail with an error indicating that the symbolic link should be dereferenced. Custom workflows for GitHub Pages are available in GitHub Enterprise Server 3.7 and later.
|
||||
known_issues:
|
||||
- |
|
||||
Custom firewall rules are removed during the upgrade process.
|
||||
|
||||
@@ -4,7 +4,7 @@ sections:
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. GitHub has requested CVE ID [CVE-2024-0507](https://www.cve.org/cverecord?id=CVE-2024-0507) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](https://docs.github.com/en/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
|
||||
@@ -40,7 +40,7 @@ sections:
|
||||
- |
|
||||
{% data reusables.release-notes.ghe-cluster-config-apply-error %}
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license where secret scanning is enabled, excessive logging in `/var/log` may cause user-facing errors and degraded system performance if logs consume all free space on the volume. To prevent this issue from impacting users, monitor free space on your instance's root volume. For more information, see "[Configuring secret scanning for your appliance](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-secret-scanning-for-your-appliance)" and "[Monitoring your appliance](/admin/enterprise-management/monitoring-your-appliance)." If you suspect that this issue is affecting your instance and you need help, [contact GitHub Support](https://support.github.com/contact). [Updated: 2023-05-03]
|
||||
- |
|
||||
|
||||
@@ -4,27 +4,27 @@ sections:
|
||||
- |
|
||||
**MEDIUM**: Updated Git to include fixes from 2.40.1. For more information, see [Git security vulnerabilities announced](https://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/) on the GitHub Blog. [Updated: 2023-07-24]
|
||||
bugs:
|
||||
- Users were unable to upload GIF files as attachments within a comment in an issue or pull request.
|
||||
- Users were unable to upload GIF files as attachments within a comment in an issue or pull request.
|
||||
- |
|
||||
A site administrator could not bypass a proxy for a top-level domain (TLD) from the instance's exception list or IANAs registered top-level domains (TLDs).
|
||||
A site administrator could not bypass a proxy for a top-level domain (TLD) from the instance's exception list or IANAs registered top-level domains (TLDs).
|
||||
- |
|
||||
On some platforms, after someone with administrative SSH access ran `ghe-diagnostics`, the command's output included a cosmetic `SG_IO` error.
|
||||
- When a site administrator used GitHub Enterprise Importer to import data from GitHub Enterprise Cloud, migrations failed during the import of file-level comments. This failure no longer prevents the import from proceeding.
|
||||
- On an instance with a GitHub Advanced Security license, users with the security manager role for an organization could not view GitHub Advanced Security settings for the organization.
|
||||
- On an instance with a large number of organizations, enterprise owners who navigated to the "Security and analysis" settings page for the enterprise could return a `500` error.
|
||||
- From GitHub Enterprise Server 3.8 onwards, using the GitHub Enterprise Importer CLI, the `startRepositoryMigration` GraphQL API, or the “Start an organization migration” REST API requires a blob storage provider to be configured in the Management Console. When using Azure Blob Storage, storage containers were incorrectly configured to be publicly accessible. Azure Blob Storage containers will now be configured to be private, and we have introduced a check that explicitly fails exports if the storage container is public.
|
||||
- When a site administrator used GitHub Enterprise Importer, import of a repository failed if a project column in the repository contained 2,500 or more archived cards.
|
||||
- In some situations on an instance with multiple nodes, Git replication failed to fully replicate repositories that had previously been deleted, which resulted in a warning in `ghe-repl-status` output.
|
||||
- On an instance with Dependabot alerts enabled, alerts were erroneously hidden when different vulnerabilities were detected by multiple build-time submission detectors.
|
||||
- GitHub Enterprise Server published distribution metrics that cannot be processed by collectd. The metrics included `pre_receive.lfsintegrity.dist.referenced_oids`, `pre_receive.lfsintegrity.dist.unknown_oids`, and `git.hooks.runtime`.
|
||||
- In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
|
||||
- On an instance with a GitHub Advanced Security license that was also configured for a timezone greater than UTC, the list of secret scanning alerts displayed a "Loading secrets failed" error if a user sorted secrets by date in descending order.
|
||||
- On an instance with a GitHub Advanced Security license where secret scanning is enabled, excessive logging in `/var/log` could cause user-facing errors and degrade system performance if logs consumed all free space on the volume.
|
||||
On some platforms, after someone with administrative SSH access ran `ghe-diagnostics`, the command's output included a cosmetic `SG_IO` error.
|
||||
- When a site administrator used GitHub Enterprise Importer to import data from GitHub Enterprise Cloud, migrations failed during the import of file-level comments. This failure no longer prevents the import from proceeding.
|
||||
- On an instance with a GitHub Advanced Security license, users with the security manager role for an organization could not view GitHub Advanced Security settings for the organization.
|
||||
- On an instance with a large number of organizations, enterprise owners who navigated to the "Security and analysis" settings page for the enterprise could return a `500` error.
|
||||
- From GitHub Enterprise Server 3.8 onwards, using the GitHub Enterprise Importer CLI, the `startRepositoryMigration` GraphQL API, or the “Start an organization migration” REST API requires a blob storage provider to be configured in the Management Console. When using Azure Blob Storage, storage containers were incorrectly configured to be publicly accessible. Azure Blob Storage containers will now be configured to be private, and we have introduced a check that explicitly fails exports if the storage container is public.
|
||||
- When a site administrator used GitHub Enterprise Importer, import of a repository failed if a project column in the repository contained 2,500 or more archived cards.
|
||||
- In some situations on an instance with multiple nodes, Git replication failed to fully replicate repositories that had previously been deleted, which resulted in a warning in `ghe-repl-status` output.
|
||||
- On an instance with Dependabot alerts enabled, alerts were erroneously hidden when different vulnerabilities were detected by multiple build-time submission detectors.
|
||||
- GitHub Enterprise Server published distribution metrics that cannot be processed by collectd. The metrics included `pre_receive.lfsintegrity.dist.referenced_oids`, `pre_receive.lfsintegrity.dist.unknown_oids`, and `git.hooks.runtime`.
|
||||
- In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
|
||||
- On an instance with a GitHub Advanced Security license that was also configured for a timezone greater than UTC, the list of secret scanning alerts displayed a "Loading secrets failed" error if a user sorted secrets by date in descending order.
|
||||
- On an instance with a GitHub Advanced Security license where secret scanning is enabled, excessive logging in `/var/log` could cause user-facing errors and degrade system performance if logs consumed all free space on the volume.
|
||||
changes:
|
||||
- On an instance with the dependency graph enabled, background services can handle more traffic.
|
||||
- On an instance with the dependency graph enabled, background services can handle more traffic.
|
||||
- |
|
||||
People with administrative SSH access who generate a support bundle using the `ghe-support-bundle` or `ghe-cluster-support-bundle` utilities can specify the period of time to gather data with `-p` or `--period` without using spaces or quotes. For example, in addition to `'-p 5 days'` or `-p '4 days 10 hours'`, `-p 5days` or `-p 4days10hours` are valid.
|
||||
- After a site administrator exports a migration archive using GitHub Enterprise Importers `gh-migrator` utility, the link to the archive remains accessible for 48 hours instead of one hour.
|
||||
- After a site administrator exports a migration archive using GitHub Enterprise Importers `gh-migrator` utility, the link to the archive remains accessible for 48 hours instead of one hour.
|
||||
known_issues:
|
||||
- |
|
||||
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-mysql-cannot-start-up %} [Updated: 2023-08-11]
|
||||
@@ -40,7 +40,7 @@ sections:
|
||||
- |
|
||||
{% data reusables.release-notes.ghe-cluster-config-apply-error %}
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -2,21 +2,21 @@ date: '2023-05-30'
|
||||
sections:
|
||||
security_fixes:
|
||||
- |
|
||||
**MEDIUM**: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com).
|
||||
**MEDIUM**: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com).
|
||||
- Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- On an instance in a cluster configuration, when upgrading the MySQL master node, the post-upgrade configuration run would take 600 seconds longer than required due to incorrect detection of unhealthy nodes.
|
||||
- On an instance with a GitHub Advanced Security license and secret scanning enabled, rotation of the key used to encrypt secrets discovered by secret scanning would fail.
|
||||
- In some situations on an instance with multiple nodes, Git replication failed to fully replicate repositories that had previously been deleted, which resulted in a warning in `ghe-repl-status` output.
|
||||
- On an instance in a cluster configuration, when upgrading the MySQL master node, the post-upgrade configuration run would take 600 seconds longer than required due to incorrect detection of unhealthy nodes.
|
||||
- On an instance with a GitHub Advanced Security license and secret scanning enabled, rotation of the key used to encrypt secrets discovered by secret scanning would fail.
|
||||
- In some situations on an instance with multiple nodes, Git replication failed to fully replicate repositories that had previously been deleted, which resulted in a warning in `ghe-repl-status` output.
|
||||
- |
|
||||
If a user made a request to the Collaborators API's Add a repository collaborator endpoint specifying a `permission` of `read` or `write`, the instance returned a `500` error.
|
||||
- On an instance with the dependency graph enabled, the correct path appears for manifests that originate from build-time submission snapshots.
|
||||
If a user made a request to the Collaborators API's Add a repository collaborator endpoint specifying a `permission` of `read` or `write`, the instance returned a `500` error.
|
||||
- On an instance with the dependency graph enabled, the correct path appears for manifests that originate from build-time submission snapshots.
|
||||
- The `spokesctl` command-line utility accepts more input formats.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and code scanning enabled, CodeQL analysis created a SARIF file that failed processing, which the API showed as pending due to an internal exception. [Updated: 2023-12-12]
|
||||
|
||||
|
||||
changes:
|
||||
- People with administrative SSH access to an instance can configure the maximum memory usage in gigabytes for Redis using `ghe-config redis.max-memory-gb VALUE`.
|
||||
- People with administrative SSH access to an instance can configure the maximum memory usage in gigabytes for Redis using `ghe-config redis.max-memory-gb VALUE`.
|
||||
known_issues:
|
||||
- |
|
||||
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-mysql-cannot-start-up %} [Updated: 2023-08-11]
|
||||
@@ -30,7 +30,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -2,19 +2,19 @@ date: '2023-06-20'
|
||||
sections:
|
||||
security_fixes:
|
||||
- |
|
||||
**MEDIUM**: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com).
|
||||
**MEDIUM**: Scoped installation tokens for a GitHub App kept approved permissions after the permissions on the integration installation were downgraded or removed. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com).
|
||||
- |
|
||||
If a user's request to the instance's API included authentication credentials within a URL parameter, administrators could see the credentials in JSON within the instance's audit log.
|
||||
- Packages have been updated to the latest security versions.
|
||||
If a user's request to the instance's API included authentication credentials within a URL parameter, administrators could see the credentials in JSON within the instance's audit log.
|
||||
- Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- |
|
||||
If an administrator updated the instance's TLS certificate using the Management Console API's [Set settings](/rest/enterprise-admin/management-console) endpoint, sending the certificate and key data as a URL query parameter resulted in the data appearing unmasked in system logs.
|
||||
- Determining suggested reviewers on a pull request could time out or be very slow.
|
||||
- After an enterprise owner set a permanent rate limit for a users GitHub App at `http(s)://HOSTNAME/stafftools/users/USERNAME/installations`, the instance did not respect the rate limit.
|
||||
- On an instance with multiple nodes, when using the `spokesctl` command-line utility to manage repositories with replicas that failed to fully create, the utility would spuriously attempt to repair healthy replicas.
|
||||
- On an instance with a GitHub Advanced Security license and code scanning enabled, code scanning could not process some SARIF files produced by newer versions of CodeQL.
|
||||
- Determining suggested reviewers on a pull request could time out or be very slow.
|
||||
- After an enterprise owner set a permanent rate limit for a users GitHub App at `http(s)://HOSTNAME/stafftools/users/USERNAME/installations`, the instance did not respect the rate limit.
|
||||
- On an instance with multiple nodes, when using the `spokesctl` command-line utility to manage repositories with replicas that failed to fully create, the utility would spuriously attempt to repair healthy replicas.
|
||||
- On an instance with a GitHub Advanced Security license and code scanning enabled, code scanning could not process some SARIF files produced by newer versions of CodeQL.
|
||||
changes:
|
||||
- If a configuration runs fails due to Elasticsearch errors, `ghe-config-apply` displays a more actionable error message.
|
||||
- If a configuration runs fails due to Elasticsearch errors, `ghe-config-apply` displays a more actionable error message.
|
||||
known_issues:
|
||||
- |
|
||||
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-mysql-cannot-start-up %} [Updated: 2023-08-11]
|
||||
@@ -28,7 +28,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -2,81 +2,81 @@ date: '2023-07-18'
|
||||
sections:
|
||||
security_fixes:
|
||||
- |
|
||||
An attacker with access to the password hash of the root site administrator user for the instance's Management Console could make requests to the password API endpoint from outside of the instance.
|
||||
An attacker with access to the password hash of the root site administrator user for the instance's Management Console could make requests to the password API endpoint from outside of the instance.
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
Packages have been updated to the latest security versions.
|
||||
- |
|
||||
**LOW:** An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To exploit this vulnerability, an attacker would need write access to the repository. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and was assigned [CVE-2023-23765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23765).
|
||||
bugs:
|
||||
- |
|
||||
If MinIO was configured for external blob storage on an instance with GitHub Actions enabled and MinIO was configured for bucket replication, the instance's credential validation with MinIO would occasionally fail.
|
||||
If MinIO was configured for external blob storage on an instance with GitHub Actions enabled and MinIO was configured for bucket replication, the instance's credential validation with MinIO would occasionally fail.
|
||||
- |
|
||||
Customers who use Azure Blob store as the remote blob provider to back GitHub Packages would have validation errors if the `EndpointSuffix` part of their Connection string was anything other than `core.windows.net`. Now all valid `EndpointSuffix` are accepted.
|
||||
Customers who use Azure Blob store as the remote blob provider to back GitHub Packages would have validation errors if the `EndpointSuffix` part of their Connection string was anything other than `core.windows.net`. Now all valid `EndpointSuffix` are accepted.
|
||||
- |
|
||||
When a user viewed a Jupyter notebook, GitHub Enterprise Server returned a `500` error code if the instance was configured with a self-signed TLS certificate.
|
||||
When a user viewed a Jupyter notebook, GitHub Enterprise Server returned a `500` error code if the instance was configured with a self-signed TLS certificate.
|
||||
- |
|
||||
After creation of a blob object from the web UI, pre-receive hook events were missing from the instance's audit log.
|
||||
After creation of a blob object from the web UI, pre-receive hook events were missing from the instance's audit log.
|
||||
- |
|
||||
On an instance in a high availability configuration, on some platforms, replication could perform poorly over links with very high latency.
|
||||
On an instance in a high availability configuration, on some platforms, replication could perform poorly over links with very high latency.
|
||||
- |
|
||||
On an instance with custom firewall rules defined, a configuration run with `ghe-config-apply` could take longer than expected.
|
||||
On an instance with custom firewall rules defined, a configuration run with `ghe-config-apply` could take longer than expected.
|
||||
- |
|
||||
On an instance with an outbound web proxy server configured, the proxy interfered with internal operations that used `nomad alloc exec`.
|
||||
On an instance with an outbound web proxy server configured, the proxy interfered with internal operations that used `nomad alloc exec`.
|
||||
- |
|
||||
On an instance in a cluster configuration, the `ghe-cluster-balance` behaved inconsistently when displaying status or managing jobs with more than one task group.
|
||||
On an instance in a cluster configuration, the `ghe-cluster-balance` behaved inconsistently when displaying status or managing jobs with more than one task group.
|
||||
- |
|
||||
On an instance configured for LDAP authentication, if the LDAP server sent an empty string for the `sshPublicKey` attribute, LDAP user sync would fail.
|
||||
On an instance configured for LDAP authentication, if the LDAP server sent an empty string for the `sshPublicKey` attribute, LDAP user sync would fail.
|
||||
- |
|
||||
When an administrator updated an instance's TLS certificate via the API as a query parameter instead of in the request body, the certificate and key appeared in `unicorn.log`.
|
||||
When an administrator updated an instance's TLS certificate via the API as a query parameter instead of in the request body, the certificate and key appeared in `unicorn.log`.
|
||||
- |
|
||||
Jobs that performed daily clean-up tasks failed to run, so old data was not removed from the MySQL database.
|
||||
Jobs that performed daily clean-up tasks failed to run, so old data was not removed from the MySQL database.
|
||||
- |
|
||||
After creation of a new Management Console user, the Management Console did not display the button to copy the new users invitation.
|
||||
After creation of a new Management Console user, the Management Console did not display the button to copy the new users invitation.
|
||||
- |
|
||||
`ghe-service-list` erroneously reported errors because the utility looked for systemd services that have been migrated to Nomad.
|
||||
`ghe-service-list` erroneously reported errors because the utility looked for systemd services that have been migrated to Nomad.
|
||||
- |
|
||||
On an instance in a high availability configuration, when adding a new node, connection checks between existing nodes would fail.
|
||||
On an instance in a high availability configuration, when adding a new node, connection checks between existing nodes would fail.
|
||||
- |
|
||||
On an instance with Dependabot enabled, in some situations, Dependabot alerts were not updated when a user pushed to a repository.
|
||||
On an instance with Dependabot enabled, in some situations, Dependabot alerts were not updated when a user pushed to a repository.
|
||||
- |
|
||||
In rare circumstances, Git commits signed with SSH keys using the RSA algorithm would incorrectly indicate the signature was invalid.
|
||||
In rare circumstances, Git commits signed with SSH keys using the RSA algorithm would incorrectly indicate the signature was invalid.
|
||||
- |
|
||||
After a migration using GitHub Enterprise Importer, some repository autolink references were created with an incorrect format.
|
||||
After a migration using GitHub Enterprise Importer, some repository autolink references were created with an incorrect format.
|
||||
- |
|
||||
In some cases on an instance without a GitHub Advanced Security license, Redis exceeded the maximum default memory allocation, causing `500` errors for the instance's users.
|
||||
In some cases on an instance without a GitHub Advanced Security license, Redis exceeded the maximum default memory allocation, causing `500` errors for the instance's users.
|
||||
- |
|
||||
On an instance with many organizations, the enterprise security overview page returned a `500` error.
|
||||
On an instance with many organizations, the enterprise security overview page returned a `500` error.
|
||||
- |
|
||||
On an instance that was not configured to deliver email notifications using SMTP, background jobs to deliver email were enqueued unnecessarily.
|
||||
On an instance that was not configured to deliver email notifications using SMTP, background jobs to deliver email were enqueued unnecessarily.
|
||||
- |
|
||||
Users were unable to configure a SSH certificate authority for an organization.
|
||||
Users were unable to configure a SSH certificate authority for an organization.
|
||||
- |
|
||||
An erroneous "Blocked Copilot Repositories" link was visible in site admin pages for organizations.
|
||||
An erroneous "Blocked Copilot Repositories" link was visible in site admin pages for organizations.
|
||||
- |
|
||||
Events related to repository notifications did not appear in the audit log.
|
||||
Events related to repository notifications did not appear in the audit log.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, in some cases, a committer would not receive an email notification for a secret scanning alert where push protections were bypassed.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, in some cases, a committer would not receive an email notification for a secret scanning alert where push protections were bypassed.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, if a user filtered by a custom pattern on an organizations "Code & security analysis" page using an invalid query, the entire GitHub Advanced Security disappeared and an error reading "Sorry, something went wrong loading GitHub Advanced Security settings" appeared.
|
||||
On an instance with a GitHub Advanced Security license, if a user filtered by a custom pattern on an organizations "Code & security analysis" page using an invalid query, the entire GitHub Advanced Security disappeared and an error reading "Sorry, something went wrong loading GitHub Advanced Security settings" appeared.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, output from Git for a push blocked by push protection always included an `http://` link.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, output from Git for a push blocked by push protection always included an `http://` link.
|
||||
- |
|
||||
Querying the audit log for `hashed_token` returned no results.
|
||||
Querying the audit log for `hashed_token` returned no results.
|
||||
- |
|
||||
The audit log reported the incorrect target repository for pre-receive hook failures.
|
||||
The audit log reported the incorrect target repository for pre-receive hook failures.
|
||||
- |
|
||||
Links to wiki pages in Markdown headers did not point to the correct path, resulting in a `404 Not Found` error.
|
||||
Links to wiki pages in Markdown headers did not point to the correct path, resulting in a `404 Not Found` error.
|
||||
- |
|
||||
GitHub Actions will now properly execute after restoring a deleted repository.
|
||||
GitHub Actions will now properly execute after restoring a deleted repository.
|
||||
- |
|
||||
On an instance with multiple nodes, when using the `spokesctl` command-line utility to manage repositories with replicas that failed to fully create, the utility would spuriously attempt to repair healthy replicas.
|
||||
On an instance with multiple nodes, when using the `spokesctl` command-line utility to manage repositories with replicas that failed to fully create, the utility would spuriously attempt to repair healthy replicas.
|
||||
changes:
|
||||
- |
|
||||
On an instance in a cluster configuration, the `ghe-cluster-config-check` command-line utility will return an affirmative message when no warnings or errors are detected. The affirmative message is "Configuration validation complete. No errors found."
|
||||
On an instance in a cluster configuration, the `ghe-cluster-config-check` command-line utility will return an affirmative message when no warnings or errors are detected. The affirmative message is "Configuration validation complete. No errors found."
|
||||
- |
|
||||
During initialization of a cluster configuration, output from the `ghe-cluster-config-init` command-line utility is improved and simplified.
|
||||
During initialization of a cluster configuration, output from the `ghe-cluster-config-init` command-line utility is improved and simplified.
|
||||
- |
|
||||
The Management Console displays a warning about unexpected consequences that may result from modification of the instance's hostname after initial configuration.
|
||||
The Management Console displays a warning about unexpected consequences that may result from modification of the instance's hostname after initial configuration.
|
||||
known_issues:
|
||||
- |
|
||||
{% data reusables.release-notes.2023-10-git-push-made-but-not-registered %} [Updated: 2023-10-26]
|
||||
@@ -88,7 +88,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account will not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -9,7 +9,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -4,31 +4,31 @@ sections:
|
||||
- |
|
||||
**LOW:** An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a reopened pull request. To exploit this vulnerability, an attacker would need write access to the repository. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com/) and was assigned [CVE-2023-23766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23766). [Updated: 2023-09-22]
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- |
|
||||
API results were incomplete, and ordering of results was incorrect if `asc` or `desc` appeared in lowercase within the API query.
|
||||
API results were incomplete, and ordering of results was incorrect if `asc` or `desc` appeared in lowercase within the API query.
|
||||
- |
|
||||
The checks in the merge box for a pull request did not always match the the checks for the most recent commit in the pull request.
|
||||
The checks in the merge box for a pull request did not always match the the checks for the most recent commit in the pull request.
|
||||
- |
|
||||
When a site administrator used GitHub Enterprise Importer on versions 3.7 and below to migrate repositories from GitHub Enterprise Server, the system backup size would increase after running many migrations due to storage files not being cleaned up.
|
||||
When a site administrator used GitHub Enterprise Importer on versions 3.7 and below to migrate repositories from GitHub Enterprise Server, the system backup size would increase after running many migrations due to storage files not being cleaned up.
|
||||
- |
|
||||
A collaborator with the "Set the social preview" permission inherited from the "Read" role couldnt upload the social preview image of a repository.
|
||||
A collaborator with the "Set the social preview" permission inherited from the "Read" role couldnt upload the social preview image of a repository.
|
||||
- |
|
||||
When running the `ghe-migrator`, certain error messages contained an invalid link to import documentation.
|
||||
When running the `ghe-migrator`, certain error messages contained an invalid link to import documentation.
|
||||
- |
|
||||
In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
|
||||
In some cases, on an instance with GitHub Actions enabled, deployment of GitHub Pages site using a GitHub Actions workflow failed with a status of `deployment_lost`.
|
||||
- |
|
||||
On an instance in a high availability configuration, existing nodes with out-of-sync repositories prevented new nodes from replicating those repositories.
|
||||
On an instance in a high availability configuration, existing nodes with out-of-sync repositories prevented new nodes from replicating those repositories.
|
||||
- |
|
||||
GitHub Enterprise Server was queuing zip jobs unnecessarily.
|
||||
GitHub Enterprise Server was queuing zip jobs unnecessarily.
|
||||
changes:
|
||||
- |
|
||||
The description of the `ghe-cluster-balance` command line utility clarifies that it can be used to balance jobs other than `github-unicorn`.
|
||||
The description of the `ghe-cluster-balance` command line utility clarifies that it can be used to balance jobs other than `github-unicorn`.
|
||||
- |
|
||||
On GitHub Enterprise Server 3.8 and above, a blob storage provider must be configured in the Management Console in order to use the GitHub Enterprise Importer CLI, "startRepositoryMigration" GraphQL API, or "Start an organization migration" REST API. The "Migrations" section in the Management Console was mistakenly removed and has been added back.
|
||||
On GitHub Enterprise Server 3.8 and above, a blob storage provider must be configured in the Management Console in order to use the GitHub Enterprise Importer CLI, "startRepositoryMigration" GraphQL API, or "Start an organization migration" REST API. The "Migrations" section in the Management Console was mistakenly removed and has been added back.
|
||||
- |
|
||||
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
|
||||
Administrators can display all repositories in a network with `spokesctl` by using the `repositories` subcommand.
|
||||
- |
|
||||
The secondary abuse rate limits of the GraphQL API are now configurable in the Management Console. [Updated: 2023-09-01]
|
||||
known_issues:
|
||||
@@ -40,7 +40,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -1,20 +1,20 @@
|
||||
date: '2023-08-24'
|
||||
sections:
|
||||
security_fixes:
|
||||
- Packages have been updated to the latest security versions.
|
||||
- Packages have been updated to the latest security versions.
|
||||
- |
|
||||
An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after the fork's visibility was changed to private. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and assigned [CVE-2023-23763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23763). [Updated: 2023-09-01]
|
||||
bugs:
|
||||
- When an administrator tried to validate blob storage connection settings for GitHub Enterprise Importer in the Management Console using the **Test storage settings** button, the operation failed.
|
||||
- syslog-ng configurations for containerized services caused errors for log forwarding services. The configurations have been removed.
|
||||
- When an instance exhausted available memory, in some cases, the system's out-of-memory killer (OOMK) killed the process for `dockerd`, causing Nomad to fail to recover after systemd restarted Docker.
|
||||
- When running the ghe-migrator, certain error messages contained an invalid link to import documentation.
|
||||
- On an instance with GitHub Actions enabled, due to mismatched values, users could not easily associate workflow job run IDs from the GitHub Enterprise Server APIs or webhooks with a job in the UI. Workflow job runs now use a new URL pattern of `...actions/runs/job/{job_id}`, and `job_id` matches values from APIs and webhook payloads.
|
||||
- On an instance with a GitHub Advanced Security license and secret scanning enabled, in some cases, custom patterns would erroneously show no results for a dry run.
|
||||
- When an administrator tried to validate blob storage connection settings for GitHub Enterprise Importer in the Management Console using the **Test storage settings** button, the operation failed.
|
||||
- syslog-ng configurations for containerized services caused errors for log forwarding services. The configurations have been removed.
|
||||
- When an instance exhausted available memory, in some cases, the system's out-of-memory killer (OOMK) killed the process for `dockerd`, causing Nomad to fail to recover after systemd restarted Docker.
|
||||
- When running the ghe-migrator, certain error messages contained an invalid link to import documentation.
|
||||
- On an instance with GitHub Actions enabled, due to mismatched values, users could not easily associate workflow job run IDs from the GitHub Enterprise Server APIs or webhooks with a job in the UI. Workflow job runs now use a new URL pattern of `...actions/runs/job/{job_id}`, and `job_id` matches values from APIs and webhook payloads.
|
||||
- On an instance with a GitHub Advanced Security license and secret scanning enabled, in some cases, custom patterns would erroneously show no results for a dry run.
|
||||
- |
|
||||
Administrators could not use the "Migrations" section in an instance's Management Console to configure blob storage for GitHub Enterprise Importer. [Updated: 2023-08-31]
|
||||
changes:
|
||||
- Administrators with SSH access to an instance can view the version of GitHub Enterprise Server on the instance by using the `-v` flag with the `ghe-version` utility.
|
||||
- Administrators with SSH access to an instance can view the version of GitHub Enterprise Server on the instance by using the `-v` flag with the `ghe-version` utility.
|
||||
known_issues:
|
||||
- |
|
||||
{% data reusables.release-notes.2023-10-git-push-made-but-not-registered %} [Updated: 2023-10-26]
|
||||
@@ -24,7 +24,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -37,7 +37,7 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/3019
|
||||
- |
|
||||
On an instance configured for SAML SSO, enterprise owners can review information about the Identity Provider (IdP) configured for user authentication using the GraphQL API. The personal access token (PAT) used to authenticate requests to this API requires the `read:enterprise` scope. Previously, the PAT required the `admin:enterprise` scope. For more information, see "[AUTOTITLE](/graphql/reference/objects#enterpriseidentityprovider)" in the GraphQL API documentation.
|
||||
On an instance configured for SAML SSO, enterprise owners can review information about the Identity Provider (IdP) configured for user authentication using the GraphQL API. The {% data variables.product.pat_generic %} (PAT) used to authenticate requests to this API requires the `read:enterprise` scope. Previously, the PAT required the `admin:enterprise` scope. For more information, see "[AUTOTITLE](/graphql/reference/objects#enterpriseidentityprovider)" in the GraphQL API documentation.
|
||||
|
||||
- heading: Authentication
|
||||
notes:
|
||||
@@ -156,7 +156,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/2896
|
||||
- |
|
||||
Administrators can bypass all protection rules for a given environment and force the pending jobs referencing the environment to proceed. For more information, see "[ AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#allow-administrators-to-bypass-configured-protection-rules)."
|
||||
Administrators can bypass all protection rules for a given environment and force the pending jobs referencing the environment to proceed. For more information, see "[AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#allow-administrators-to-bypass-configured-protection-rules)."
|
||||
|
||||
# https://github.com/github/releases/issues/2801
|
||||
- |
|
||||
@@ -389,7 +389,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -37,7 +37,7 @@ sections:
|
||||
notes:
|
||||
# https://github.com/github/releases/issues/3019
|
||||
- |
|
||||
On an instance configured for SAML SSO, enterprise owners can review information about the Identity Provider (IdP) configured for user authentication using the GraphQL API. The personal access token (PAT) used to authenticate requests to this API requires the `read:enterprise` scope. Previously, the PAT required the `admin:enterprise` scope. For more information, see "[AUTOTITLE](/graphql/reference/objects#enterpriseidentityprovider)" in the GraphQL API documentation.
|
||||
On an instance configured for SAML SSO, enterprise owners can review information about the Identity Provider (IdP) configured for user authentication using the GraphQL API. The {% data variables.product.pat_generic %} (PAT) used to authenticate requests to this API requires the `read:enterprise` scope. Previously, the PAT required the `admin:enterprise` scope. For more information, see "[AUTOTITLE](/graphql/reference/objects#enterpriseidentityprovider)" in the GraphQL API documentation.
|
||||
|
||||
- heading: Authentication
|
||||
notes:
|
||||
@@ -156,7 +156,7 @@ sections:
|
||||
|
||||
# https://github.com/github/releases/issues/2896
|
||||
- |
|
||||
Administrators can bypass all protection rules for a given environment and force the pending jobs referencing the environment to proceed. For more information, see "[ AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#allow-administrators-to-bypass-configured-protection-rules)."
|
||||
Administrators can bypass all protection rules for a given environment and force the pending jobs referencing the environment to proceed. For more information, see "[AUTOTITLE](/actions/deployment/targeting-different-environments/using-environments-for-deployment#allow-administrators-to-bypass-configured-protection-rules)."
|
||||
|
||||
# https://github.com/github/releases/issues/2801
|
||||
- |
|
||||
@@ -395,7 +395,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -114,7 +114,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ sections:
|
||||
- |
|
||||
On an instance in a cluster configuration, after you upgrade nodes other than the primary MySQL node and before you upgrade the primary MySQL node, the following output may appear multiple times after you run `ghe-config-apply`.
|
||||
|
||||
```
|
||||
```shell
|
||||
Error response from daemon: conflict: unable to delete IMAGE_ID (cannot be forced) - image is being used by running container CONTAINER_ID
|
||||
```
|
||||
|
||||
|
||||
@@ -43,7 +43,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -29,7 +29,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -18,7 +18,7 @@ sections:
|
||||
- When running the `ghe-saml-mapping-csv` CLI command in dry run mode, the operation failed with errors.
|
||||
- When uploading migration archives to blob storage, the GitHub Enterprise Server instance's outbound web proxy server was not used.
|
||||
- On an enterprise with the policy setting that disallows repository admins from enabling/disabling secret scanning, transferring a repository to a new organization that automatically enabled secret scanning wouldn't result in the transferred repository being automatically enabled for secret scanning.
|
||||
- When viewing fine-grained personal access tokens, the permissions text for pre-receive hooks was not visible for selection when filtering by permission.
|
||||
- When viewing {% data variables.product.pat_v2_plural %}, the permissions text for pre-receive hooks was not visible for selection when filtering by permission.
|
||||
- When migrating a repository from a GitHub Enterprise Server instance to another location, the `ghe-migrator target_url` command allows you to record the repository's new location. The new URL is displayed when you visit the main page of the repository in the web interface.
|
||||
- On an instance with subdomain isolation disabled, a notebook could not be loaded due to incorrect asset paths.
|
||||
- On an instance with subdomain isolation disabled, a notebook could not be loaded due to an extra `/` character in the URL path.
|
||||
@@ -26,7 +26,7 @@ sections:
|
||||
- On an instance with GitHub Actions enabled, the software on ephemeral runners would not automatically update to the latest version.
|
||||
- '{% data reusables.release-notes.mermaid-rendering-known-issue %}'
|
||||
changes:
|
||||
- When listing the node metadata for all nodes using the [Manage GitHub Enterprise Server REST API](https://docs.github.com/enterprise-server/rest/enterprise-admin/manage-ghes?apiVersion=2022-11-28#get-all-ghes-node-metadata-for-all-nodes), information about whether a given node is a replica is included.
|
||||
- When listing the node metadata for all nodes using the [Manage GitHub Enterprise Server REST API](/enterprise-server/rest/enterprise-admin/manage-ghes?apiVersion=2022-11-28#get-all-ghes-node-metadata-for-all-nodes), information about whether a given node is a replica is included.
|
||||
- When GitHub Enterprise checks for a new upgrade or hotpatch package, if the check fails the failure details are output to the `ghe-update-check` log, and the Management Console UI provides a "Check Again" button to rerun the check.
|
||||
- When providing data to GitHub Support, GitHub Enterprise Server displays a notice describing how support data is used before uploading the support files.
|
||||
- When running async repository repairs, the output message about scheduling a repair job is more accurate.
|
||||
@@ -39,7 +39,7 @@ sections:
|
||||
- |
|
||||
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
|
||||
- |
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](https://docs.github.com/en/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[Troubleshooting access to the Management Console](/enterprise-server@3.8/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." [Updated: 2023-02-23]
|
||||
- |
|
||||
On an instance in a high-availability configuration, passive replica nodes accept Git client requests and forward the requests to the primary node.
|
||||
- |
|
||||
|
||||
@@ -9,22 +9,22 @@ sections:
|
||||
security_fixes:
|
||||
- |
|
||||
**HIGH**: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of private mode by using a specially crafted API request. Private mode is the mechanism that enforces authentication for publicly-scoped resources. For more information, see "[AUTOTITLE](/admin/configuration/hardening-security-for-your-enterprise/enabling-private-mode)."
|
||||
|
||||
|
||||
This vulnerability would allow unauthenticated attackers to gain access to various types of resources set as public on the instance. To exploit this vulnerability, an attacker would need network access to the GitHub Enterprise Server instance configured in private mode. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-6847](https://www.cve.org/cverecord?id=CVE-2023-6847).
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges by making requests to the endpoint used for bootstrapping the instance, and then reset the root site administrator password. GitHub has requested CVE ID [CVE-2023-46647](https://www.cve.org/cverecord?id=CVE-2023-46647) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
**HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46645](https://www.cve.org/cverecord?id=CVE-2023-46645).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
**MEDIUM**: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server backend service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6746](https://www.cve.org/cverecord?id=CVE-2023-6746) for this vulnerability.
|
||||
- |
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
**MEDIUM**: Due to an insufficient entropy vulnerability, an attacker could brute force a user invitation to the Management Console. To exploit this vulnerability, an attacker would have needed knowledge that a user invitation was pending. This vulnerability was reported via the [GitHub Bug Bounty](https://bounty.github.com/) program and assigned [CVE-2023-46648](https://www.cve.org/CVERecord?id=CVE-2023-46648).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access via a race condition when an organization was converted from a user. GitHub has requested CVE ID [CVE-2023-46649](https://www.cve.org/cverecord?id=CVE-2023-46649) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: Due to an improper access control, an attacker could view private repository names by enumerating check run IDs with the "Get a check run" API endpoint. This vulnerability did not allow unauthorized access to any repository content other than the name. GitHub has requested CVE ID [CVE-2023-46646](https://www.cve.org/cverecord?id=CVE-2023-46646) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**MEDIUM**: An attacker could maintain admin access to a transferred repository in a race condition by making a GraphQL mutation to alter repository permissions during the transfer. GitHub has requested CVE ID [CVE-2023-6690](https://www.cve.org/cverecord?id=CVE-2023-6690) for this vulnerability, which reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An insertion of sensitive information into log file in the audit log in GitHub Enterprise Server was identified that that could allow an attacker to gain access to the Management Console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server instance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. GitHub has requested CVE ID [CVE-2023-6802](https://www.cve.org/CVERecord?id=CVE-2023-6802) for this vulnerability.
|
||||
- |
|
||||
@@ -32,103 +32,103 @@ sections:
|
||||
- |
|
||||
**MEDIUM**: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. GitHub has requested CVE ID [CVE-2023-6804](https://www.cve.org/cverecord?id=CVE-2023-6804) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required `contents.write` and `issues.read` permissions. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51379](https://www.cve.org/CVERecord?id=CVE-2023-51379).
|
||||
- |
|
||||
**MEDIUM**: An incorrect authorization vulnerability was identified that allowed issue comments to be read with an improperly scoped token. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2023-51380](https://www.cve.org/CVERecord?id=CVE-2023-51380).
|
||||
- |
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
**LOW:** Pre-receive hooks have been further hardened against shell command injections.
|
||||
- |
|
||||
**LOW:** To render interactive maps in an instance's web UI using Azure Maps, GitHub Enterprise Server has migrated from use of an unsecure Azure Maps API token to a more secure access token provided by role-based access control (RBAC) in Entra ID. After upgrading to this release, to re-enable interactive maps, an administrator must reconfigure authentication to Azure Maps in the Management Console. For more information, see "[AUTOTITLE](/admin/configuration/configuring-user-applications-for-your-enterprise/configuring-interactive-maps)."
|
||||
- |
|
||||
To address scenarios that could lead to denial of service, HAProxy has been upgraded to version 2.8.4.
|
||||
To address scenarios that could lead to denial of service, HAProxy has been upgraded to version 2.8.4.
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
- |
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
In rare cases, on an instance with GitHub Actions enabled, a failed check on a deleted repository could cause upgrades to a new version of GitHub Enterprise Server to fail.
|
||||
- |
|
||||
Threads in the Git proxy service `babeld` could crash while reading Git packet lines.
|
||||
Threads in the Git proxy service `babeld` could crash while reading Git packet lines.
|
||||
- |
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
When an administrator ran the `ghe-support-bundle` or `ghe-cluster-support-bundle` command, the `-p` flag did not produce bundles with log durations as specified. The duration period can now only be specified in `days`. Additionally, unnecessary files were sanitized by the commands.
|
||||
- |
|
||||
On an instance in a cluster configuration, site administrators using the `ghe-config-apply` utility may have seen the extraneous message "Error: Server closed the connection" in the logs for the utility.
|
||||
On an instance in a cluster configuration, site administrators using the `ghe-config-apply` utility may have seen the extraneous message "Error: Server closed the connection" in the logs for the utility.
|
||||
- |
|
||||
Some OAuth applications did not have device code flow (DCF) explicitly enabled, which prevented DCF from running correctly.
|
||||
Some OAuth applications did not have device code flow (DCF) explicitly enabled, which prevented DCF from running correctly.
|
||||
- |
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
On an instance in a cluster configuration, upgrades could fail due to a background job running during database migration.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, site administrators using the `ghe-secret-scanning` command would not see a relevant error message if their input was invalid.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, some maintenance tasks could fail due to incomplete upgrade steps during previous upgrades to new releases of GitHub Enterprise Server.
|
||||
On an instance with GitHub Actions enabled, some maintenance tasks could fail due to incomplete upgrade steps during previous upgrades to new releases of GitHub Enterprise Server.
|
||||
- |
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
On an instance in a high availability configuration, the `ghe-repl-teardown` command failed when provided with a UUID.
|
||||
- |
|
||||
Support for authenticating to GitHub Enterprise Server from Visual Studio Code with a device code was unintentionally disabled.
|
||||
Support for authenticating to GitHub Enterprise Server from Visual Studio Code with a device code was unintentionally disabled.
|
||||
- |
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
In some environments, stale `.backup` log files could accumulate in the system.
|
||||
- |
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
On an instance hosted on AWS, when configuring GitHub Packages, virtual-hosted-style AWS S3 URLs would default to path-style URLs if a `region-code` was included. For more information, see [Virtual hosting of buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html) in the AWS documentation.
|
||||
- |
|
||||
In some cases, when an administrator uploaded a custom TLS certificate, the certificate was not correctly installed on the instance.
|
||||
In some cases, when an administrator uploaded a custom TLS certificate, the certificate was not correctly installed on the instance.
|
||||
- |
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
Because the `|` character was not permitted, administrators could not add an SMTP username to authenticate with the Azure Communication Service.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
On an instance with a GitHub Advanced Security license, users with the security manager role could not update custom links for push protection using the REST API.
|
||||
- |
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
On an instance with the dependency graph enabled, some security products were not automatically enabled for new public repositories.
|
||||
- |
|
||||
Deprecated `resource_activity` jobs were not processed and accumulated over time in the queue, causing possible memory issues.
|
||||
Deprecated `resource_activity` jobs were not processed and accumulated over time in the queue, causing possible memory issues.
|
||||
- |
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
Pull request review threads at the file level, rather than the individual line level, were not included in exports from `ghe-migrator` or the Organization Migrations API.
|
||||
- |
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
After importing a migration archive using `ghe-migrator` or REST API endpoints for organization migrations, in some cases, some review comments within pull requests were not associated with lines of code.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, secret scanning alert emails were sent to organization owners even if their email address did not comply with domain restrictions.
|
||||
- |
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
After a user started a repository transfer, if another user viewed the repository before the transfer finished, the repository overview rendered incorrectly.
|
||||
- |
|
||||
On an instance with GitHub Connect and unified search enabled, users trying to view the unified search code results would get a 500 error.
|
||||
On an instance with GitHub Connect and unified search enabled, users trying to view the unified search code results would get a 500 error.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
On an instance with GitHub Actions enabled, users occasionally got a 500 error when viewing a job with a pending deployment.
|
||||
- |
|
||||
On an instance with GitHub Actions enabled, an issue with `GH_TOKEN` sometimes prevented GitHub Pages sites from building successfully in workflows.
|
||||
On an instance with GitHub Actions enabled, an issue with `GH_TOKEN` sometimes prevented GitHub Pages sites from building successfully in workflows.
|
||||
- |
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
An administrator could enable GitHub Connect on an instance with a license that does not support GitHub Connect.
|
||||
- |
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
On an instance with GitHub Connect enabled, some system users were incorrectly counted as consuming a license following license sync.
|
||||
- |
|
||||
The enterprise account pages on some installations rendered very slowly.
|
||||
The enterprise account pages on some installations rendered very slowly.
|
||||
- |
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
A user in the process of being converted into an organization could be added as a collaborator on a repository. This resulted in the new organizations owners unexpectedly receiving access to the repository.
|
||||
- |
|
||||
When using `ghe-migrator` to import repositories into GitHub Enterprise Server, the `conflicts` and `audit` subcommands produced an invalid CSV file due to an extra log line appended to the file.
|
||||
When using `ghe-migrator` to import repositories into GitHub Enterprise Server, the `conflicts` and `audit` subcommands produced an invalid CSV file due to an extra log line appended to the file.
|
||||
- |
|
||||
On an instance with subdomain isolation disabled, a notebook could not be loaded due to incorrect asset paths.
|
||||
On an instance with subdomain isolation disabled, a notebook could not be loaded due to incorrect asset paths.
|
||||
- |
|
||||
Running `ghe-spokesctl gov info` without any arguments caused a `panic` response.
|
||||
Running `ghe-spokesctl gov info` without any arguments caused a `panic` response.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, dry runs sometimes incorrectly reported no results for custom patterns.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
On an instance with a GitHub Advanced Security license and secret scanning enabled, webhooks for alert locations did not contain information about push protection bypasses.
|
||||
- |
|
||||
On an instance with a GitHub Advanced Security license, code scanning would report an incorrect number of files scanned on the "Tools" status page.
|
||||
On an instance with a GitHub Advanced Security license, code scanning would report an incorrect number of files scanned on the "Tools" status page.
|
||||
changes:
|
||||
- |
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
On an instance with Dependabot updates enabled, Dependabot relies on the node installation provided by the actions runner instead of dynamically downloading.
|
||||
- |
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
When adding a node to an instance, performance is improved during initial database replication.
|
||||
- |
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
An administrator can run the new `ghe-check-background-upgrade-jobs` command to ensure all upgrade jobs that run in the background have finished. This allows the administrator to know when they can start the next upgrade to their GitHub Enterprise Server instance.
|
||||
- |
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
To avoid negative effects on disk utilization, `babeld` log files have a maximum size of 15 GB.
|
||||
- |
|
||||
Instance administrators can manage search indices for GitHub Discussions from the site admin dashboard.
|
||||
Instance administrators can manage search indices for GitHub Discussions from the site admin dashboard.
|
||||
- |
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
To improve reliability of release uploads in low-bandwidth environments, the time-to-live (TTL) value of the token for uploading release assets has increased from 1 hour to 3 hours.
|
||||
- |
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
When using `ghe-migrator prepare` to import an archive, a missing `schema.json` file results in an `UnsupportedArchive` error rather than an `UnsupportedSchemaVersion` error.
|
||||
- |
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
The audit log now tracks all failed password attempts individually. Previously, duplicate failed password attempts in sequence within the same day would be grouped into one failed password attempt, with a `count` field.
|
||||
known_issues:
|
||||
- |
|
||||
Custom firewall rules are removed during the upgrade process.
|
||||
|
||||
@@ -10,7 +10,7 @@ sections:
|
||||
- |
|
||||
**HIGH**: An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. GitHub has requested CVE ID [CVE-2024-0507](https://www.cve.org/cverecord?id=CVE-2024-0507) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](https://docs.github.com/en/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
**HIGH**: An attacker could leverage an unsafe reflection vulnerability in GitHub Enterprise Server (GHES) that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the [organization owner role](/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners). GitHub has requested CVE ID [CVE-2024-0200](https://www.cve.org/cverecord?id=CVE-2024-0200) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
|
||||
- |
|
||||
Packages have been updated to the latest security versions.
|
||||
bugs:
|
||||
@@ -70,8 +70,8 @@ sections:
|
||||
errata:
|
||||
- |
|
||||
These release notes previously indicated that GitHub Enterprise Server 3.9.8 contained fixes for the following issues:
|
||||
|
||||
|
||||
- An improper authentication vulnerability that affected private mode, [CVE-2023-6847](https://www.cve.org/cverecord?id=CVE-2023-6847)
|
||||
- An incorrect authorization vulnerability that affected issue comments, [CVE-2023-51380](https://www.cve.org/CVERecord?id=CVE-2023-51380)
|
||||
|
||||
|
||||
These fixes were included in GitHub Enterprise Server [3.9.7](/admin/release-notes#3.9.7-security-fixes).
|
||||
|
||||
@@ -8,7 +8,7 @@ intro: |
|
||||
sections:
|
||||
bugs:
|
||||
- |
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
The instance incorrectly wrote the output for multiple workloads to `/var/log/syslog.log`.
|
||||
- |
|
||||
During periods of high traffic, interruptions in service occurred due to insufficient resource allocations for internal components.
|
||||
- |
|
||||
|
||||
@@ -111,6 +111,7 @@ pat_generic_caps_plural: 'Personal access tokens'
|
||||
pat_generic_title_case: 'Personal Access Token'
|
||||
pat_generic_title_case_plural: 'Personal Access Tokens'
|
||||
pat_v2: 'fine-grained personal access token'
|
||||
pat_v2_plural: 'fine-grained personal access tokens'
|
||||
pat_v2_caps: 'Fine-grained personal access token'
|
||||
pat_v1: >-
|
||||
{% ifversion pat-v2 %}personal access token (classic){% else %}personal access token{% endif %}
|
||||
@@ -287,7 +288,7 @@ current-340-version: '11.10.354'
|
||||
# Developer site product variables
|
||||
# Use this inside command-line and other code blocks
|
||||
doc_url_pre: >-
|
||||
{% ifversion fpt or ghec %}https://docs.github.com/rest{% elsif ghes %}https://docs.github.com/enterprise/{{ currentVersion | version_num }}/rest{% endif %}
|
||||
{% ifversion fpt or ghec %}https://docs.github.com/rest{% elsif ghes %}https://docs.github.com/enterprise/{{ currentVersion | version_num }}/rest{% endif %}<!-- markdownlint-disable-line search-replace -->
|
||||
# Use this inside command-line code blocks
|
||||
api_url_pre: >-
|
||||
{% ifversion fpt or ghec %}https://api.github.com{% elsif ghes %}http(s)://<em>HOSTNAME</em>/api/v3{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user