Skip to content

Commit f012562

Browse files
release-controller[bot]Release-Controllerpallsamafelicitymayrachaelrenk
authored
Patch release notes for GitHub Enterprise Server (#54004)
Co-authored-by: Release-Controller <[email protected]> Co-authored-by: Pallavi <[email protected]> Co-authored-by: Felicity Chapman <[email protected]> Co-authored-by: Rachael Rose Renk <[email protected]>
1 parent b1cf6bd commit f012562

File tree

4 files changed

+247
-0
lines changed

4 files changed

+247
-0
lines changed

‎data/release-notes/enterprise-server/3-12/14.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
date: '2025-01-21'
2+
sections:
3+
security_fixes:
4+
- |
5+
**HIGH:** An attacker could forge a SAML response to provision and/or gain access to an account with administrator privileges for GitHub Enterprise Server instances that use SAML single sign-on authentication. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user are not impacted. Exploitation of this vulnerability would allow for signature spoofing by improper validation. GitHub has requested CVE ID [CVE-2025-23369](https://www.cve.org/cverecord?id=CVE-2025-23369) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
Packages have been updated to the latest security versions.
8+
bugs:
9+
- |
10+
Restore failed silently on incremental MySQL backups.
11+
- |
12+
On an instance with GitHub Actions enabled, a configuration run could hang if the blob storage was inaccessible.
13+
- |
14+
After an initial reboot, the appliance sometimes altered the ownership permissions of `gitmon` directories. As a result, the Management Console could hang at the "Starting" phase.
15+
- |
16+
Repository archive exports failed when the archive was more than 5 GiB.
17+
- |
18+
`ghe-migrator` imports could fail due to attachments with invalid model types.
19+
changes:
20+
- |
21+
To avoid service disruption, the bundled action `actions/setup-dotnet` uses new .NET CDN URLs. See https://github.com/dotnet/core/issues/9671.
22+
- |
23+
To avoid unnecessary error messages when users attempt to create a ruleset in evaluate mode in a repository that is user owned, we removed the evaluate mode option on the ruleset.
24+
known_issues:
25+
- |
26+
Custom firewall rules are removed during the upgrade process.
27+
- |
28+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
29+
- |
30+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
31+
- |
32+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
33+
- |
34+
{% data reusables.release-notes.2023-11-aws-system-time %}
35+
- |
36+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
37+
- |
38+
{% data reusables.release-notes.large-adoc-files-issue %}
39+
- |
40+
Repositories originally imported using ghe-migrator will not correctly track Advanced Security contributions.
41+
- |
42+
The `reply.[hostname]` subdomain is falsely always displaying as having no ssl and dns record, when testing the domain settings via management console **without subdomain isolation**. When regenerating the certificates with management console, the `subdomain reply.[hostname]` is missing from the ssl certification.
43+
- |
44+
Admin stats REST API endpoints may timeout on appliances with many users or repositories. Retrying the request until data is returned is advised.
45+
- |
46+
{% data reusables.release-notes.2024-06-possible-frontend-5-minute-outage-during-hotpatch-upgrade %}
47+
- |
48+
When restoring from a backup snapshot, a large number of `mapper_parsing_exception` errors may be displayed.
49+
- |
50+
Some customers upgrading from 3.11.x or 3.12.x may experience a bug with the feature "Automatic update checks", filling the root disk with logs causing a system degradation. To prevent this, you can turn off the feature "[Enable automatic update check](/admin/upgrading-your-instance/preparing-to-upgrade/enabling-automatic-update-checks#enabling-automatic-update-checks)" in the management console.

‎data/release-notes/enterprise-server/3-13/10.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
date: '2025-01-21'
2+
sections:
3+
security_fixes:
4+
- |
5+
**HIGH:** An attacker could forge a SAML response to provision and/or gain access to an account with administrator privileges for GitHub Enterprise Server instances that use SAML single sign-on authentication. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user are not impacted. Exploitation of this vulnerability would allow for signature spoofing by improper validation. GitHub has requested CVE ID [CVE-2025-23369](https://www.cve.org/cverecord?id=CVE-2025-23369) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
Packages have been updated to the latest security versions.
8+
bugs:
9+
- |
10+
Restore failed silently on incremental MySQL backups.
11+
- |
12+
On an instance with GitHub Actions enabled, a configuration run could hang if the blob storage was inaccessible.
13+
- |
14+
Site administrators using `ghe-config-apply` saw `rm cannot remove DIRECTORY` errors. Old log directories are now removed without reporting errors.
15+
- |
16+
After an initial reboot, the appliance sometimes altered the ownership permissions of `gitmon` directories. As a result, the Management Console could hang at the "Starting" phase.
17+
- |
18+
The view for a repository's "top contributors" failed to render when when it received invalid parameters.
19+
- |
20+
Repository archive exports failed when the archive was more than 5 GiB.
21+
- |
22+
The SAML SSO and SCIM identity of the user (actor) who performed the action, `external_identity_nameid`, was omitted from the metadata for audit log entries.
23+
- |
24+
If you unarchived a repository with secret scanning enabled and then enabled GitHub Advanced Security, the feature settings were incorrectly reported by security overview. Secret scanning was shown as disabled.
25+
- |
26+
`ghe-migrator` imports could fail due to attachments with invalid model types.
27+
changes:
28+
- |
29+
To avoid service disruption, the bundled action `actions/setup-dotnet` uses new .NET CDN URLs. See https://github.com/dotnet/core/issues/9671.
30+
- |
31+
To avoid unnecessary error messages when users attempt to create a ruleset in evaluate mode in a repository that is user owned, we removed the evaluate mode option on the ruleset.
32+
- |
33+
Log output for git maintenance now includes the time taken to complete the maintenance process.
34+
known_issues:
35+
- |
36+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
37+
- |
38+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
39+
- |
40+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
41+
- |
42+
Repositories originally imported using ghe-migrator will not correctly track Advanced Security contributions.
43+
- |
44+
For an instance in a cluster configuration and with GitHub Actions enabled, restoring a cluster from backup requires targeting the primary DB node.
45+
- |
46+
When following the steps for [Replacing the primary MySQL node](/[email protected]/admin/monitoring-managing-and-updating-your-instance/configuring-clustering/replacing-a-cluster-node#replacing-the-primary-mysql-node), step 14 (running `ghe-cluster-config-apply`) might fail with errors. If this occurs, re-running `ghe-cluster-config-apply` is expected to succeed.
47+
- |
48+
Running a config apply as part of the steps for [Replacing a node in an emergency](/admin/monitoring-managing-and-updating-your-instance/configuring-clustering/replacing-a-cluster-node#replacing-a-node-in-an-emergency) may fail with errors if the node being replaced is still reachable. If this occurs, shutdown the node and repeat the steps.
49+
- |
50+
{% data reusables.release-notes.2024-06-possible-frontend-5-minute-outage-during-hotpatch-upgrade %}
51+
- |
52+
When restoring data originally backed up from a 3.13 appliance onto a 3.13 appliance, the elasticsearch indices need to be reindexed before some of the data will show up. This happens via a nightly scheduled job. It can also be forced by running `/usr/local/share/enterprise/ghe-es-search-repair`.
53+
- |
54+
When restoring from a backup snapshot, a large number of `mapper_parsing_exception` errors may be displayed.

‎data/release-notes/enterprise-server/3-14/7.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
date: '2025-01-21'
2+
sections:
3+
security_fixes:
4+
- |
5+
**HIGH:** An attacker could forge a SAML response to provision and/or gain access to an account with administrator privileges for GitHub Enterprise Server instances that use SAML single sign-on authentication. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user are not impacted. Exploitation of this vulnerability would allow for signature spoofing by improper validation. GitHub has requested CVE ID [CVE-2025-23369](https://www.cve.org/cverecord?id=CVE-2025-23369) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
6+
- |
7+
Packages have been updated to the latest security versions.
8+
bugs:
9+
- |
10+
Restore failed silently on incremental MySQL backups.
11+
- |
12+
On an instance with GitHub Actions enabled, a configuration run could hang if the blob storage was inaccessible.
13+
- |
14+
Site administrators using `ghe-config-apply` saw `rm cannot remove DIRECTORY` errors. Old log directories are now removed without reporting errors.
15+
- |
16+
After an initial reboot, the appliance sometimes altered the ownership permissions of `gitmon` directories. As a result, the Management Console could hang at the "Starting" phase.
17+
- |
18+
The view for a repository's "top contributors" failed to render when when it received invalid parameters.
19+
- |
20+
Repository archive exports failed when the archive was more than 5 GiB.
21+
- |
22+
When users bypassed push protections for a file upload but did not re-add the file after the bypass was created, an incorrect error message displayed.
23+
- |
24+
The SAML SSO and SCIM identity of the user (actor) who performed the action, `external_identity_nameid`, was omitted from the metadata for audit log entries.
25+
- |
26+
If you unarchived a repository with secret scanning enabled and then enabled GitHub Advanced Security, the feature settings were incorrectly reported by security overview. Secret scanning was shown as disabled.
27+
- |
28+
`ghe-migrator` imports could fail due to attachments with invalid model types.
29+
changes:
30+
- |
31+
To avoid service disruption, the bundled action `actions/setup-dotnet` uses new .NET CDN URLs. See https://github.com/dotnet/core/issues/9671.
32+
- |
33+
To avoid unnecessary error messages when users attempt to create a ruleset in evaluate mode in a repository that is user owned, we removed the evaluate mode option on the ruleset.
34+
known_issues:
35+
- |
36+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
37+
- |
38+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
39+
- |
40+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
41+
- |
42+
{% data reusables.release-notes.large-adoc-files-issue %}
43+
- |
44+
Repositories originally imported using ghe-migrator will not correctly track Advanced Security contributions.
45+
- |
46+
Admin stats REST API endpoints may timeout on appliances with many users or repositories. Retrying the request until data is returned is advised.
47+
- |
48+
When following the steps for [Replacing the primary MySQL node](/[email protected]/admin/monitoring-managing-and-updating-your-instance/configuring-clustering/replacing-a-cluster-node#replacing-the-primary-mysql-node), step 14 (running `ghe-cluster-config-apply`) might fail with errors. If this occurs, re-running `ghe-cluster-config-apply` is expected to succeed.
49+
- |
50+
Running a config apply as part of the steps for [Replacing a node in an emergency](/admin/monitoring-managing-and-updating-your-instance/configuring-clustering/replacing-a-cluster-node#replacing-a-node-in-an-emergency) may fail with errors if the node being replaced is still reachable. If this occurs, shutdown the node and repeat the steps.
51+
- |
52+
{% data reusables.release-notes.2024-06-possible-frontend-5-minute-outage-during-hotpatch-upgrade %}
53+
- |
54+
When restoring data originally backed up from a 3.13 appliance onto a 3.13 appliance, the elasticsearch indices need to be reindexed before some of the data will show up. This happens via a nightly scheduled job. It can also be forced by running `/usr/local/share/enterprise/ghe-es-search-repair`.
55+
- |
56+
An organization-level code scanning configuration page is displayed on instances that do not use GitHub Advanced Security or code scanning.
57+
- |
58+
When following the steps for [Replacing the primary MySQL node](/admin/monitoring-managing-and-updating-your-instance/configuring-clustering/replacing-a-cluster-node#replacing-the-primary-mysql-node), step 14 (running `ghe-cluster-config-apply`) might fail with errors. If this occurs, re-running `ghe-cluster-config-apply` is expected to succeed.
59+
- |
60+
In the header bar displayed to site administrators, some icons are not available.
61+
- |
62+
When enabling automatic update checks for the first time in the Management Console, the status is not dynamically reflected until the "Updates" page is reloaded.
63+
- |
64+
When restoring from a backup snapshot, a large number of `mapper_parsing_exception` errors may be displayed.

0 commit comments

Comments
 (0)