2.20 Release notes
2.21Enterprise Server 2.20.24
DownloadMarch 01, 2021
-
HIGH: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22861. This issue was reported via the GitHub Bug Bounty Program.
-
HIGH: An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22863. This issue was reported via the GitHub Bug Bounty Program.
-
HIGH: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability has been assigned CVE-2020-10519 and was reported via the GitHub Bug Bounty Program.
-
LOW: A specially crafted request to the SVN bridge could trigger a long wait before failure resulting in Denial of Service (DoS).
-
Packages have been updated to the latest security versions.
-
An informational message was unintentionally logged as an error during GitHub Enterprise Backup Utilities snapshots, which resulted in unnecessary emails being sent when backups were scheduled by cron jobs that listen for output to stderr.
-
While restoring a large backup, exception logging related to Redis memory exhaustion could cause the restore to fail due to a full disk.
-
When editing a wiki page a user could experience a 500 error when clicking the Save button.
-
An S/MIME signed commit using a certificate with multiple names in the subject alternative name would incorrectly show as "Unverified" in the commit badge.
-
Suspended user was sent emails when added to a team.
-
When uploading a new license file with a different number of seats from the previous license file, the seat difference was not correctly represented in the enterprise account Settings -> License page.
-
The "Prevent repository admins from changing anonymous Git read access" checkbox available in the enterprise account settings could not be successfully enabled or disabled.
-
During a leap year, the user was getting a 404 response when trying to view Contribution activity on a Monday.
-
Added support for AWS EC2 r5b instance types.
-
Adjusted background queue prioritization to more evenly distribute jobs.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.23
DownloadDecember 16, 2020
-
LOW: High CPU usage could be triggered by a specially crafted request to the SVN bridge resulting in Denial of Service (DoS).
-
Packages have been updated to the latest security versions.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.22
DownloadDecember 02, 2020
-
Authorization service was being detected as unhealthy due to a race condition in the bootstrap which led to restart of the service.
-
An underlying behavior was causing a service to become unavailable during the hotpatch upgrade process.
-
A subset of log forwarding SSL certificates was not being applied correctly.
-
Email notifications sent to suspended users when they were removed from a Team or an Organization.
-
The way SSH certificates were applied between Organizations and Businesses was inconsistent.
-
When an account was rate limited due to using incorrect passwords, it could be locked out for up to 24 hours.
-
Pull request synchronization on repositories with many references could cause worker queues to fall behind.
-
When signing in after attempting to visit a specific page, people were sent to the home page instead of their intended destination.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.21
DownloadNovember 16, 2020
-
Packages have been updated to the latest security versions.
-
The babeld logs were missing a separator between seconds and microseconds.
-
When the enterprise account "Repository visibility change" policy was set to "Enabled", organization owners could not change the visibility of repositories within the organization.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.20
DownloadNovember 02, 2020
-
MEDIUM: High CPU usage could be triggered by a specially crafted request to the SVN bridge resulting in Denial of Service (DoS).
-
LOW: Incorrect token validation resulted in a reduced entropy for matching tokens during authentication. Analysis shows that in practice there's no significant security risk here.
-
Packages have been updated to the latest security versions.
-
Suspended users were included in the list of suggested users, potentially hiding unsuspended users.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.19
DownloadOctober 19, 2020
-
Packages have been updated to the latest security versions.
-
The enterprise account "Confirm two-factor requirement policy" messaging was incorrect.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.18
DownloadOctober 08, 2020
-
A user whose LDAP directory username standardizes to an existing GHES account login could authenticate into the existing account.
-
Packages have been updated to the latest security versions.
-
The NameID Format dropdown in the Management Console would be reset to "unspecified" after setting it to "persistent".
-
Saving settings via the management console would append a newline to the TLS/SSL certificate and key files which triggered unnecessary reloading of some services.
-
System logs for Dependency Graph were not rotating, allowing unbounded storage growth.
-
Links to GitHub Security Advisories would use a URL with the hostname of the GitHub Enterprise Server instance instead of GitHub.com, directing the user to a nonexistent URL.
-
When importing a repository with
ghe-migrator, an unexpected exception could occur when inconsistent data is present. -
When using
ghe-migratorto import PR review requests, records associated with deleted users would result in extraneous database records. -
When importing users with
ghe-migrator, an error of "Emails is invalid" would occur if the system-generated email address were longer than 100 characters. -
Logging webhook activity could use large amounts of disk space and cause the root disk to become full.
-
Support is added for the AWS EC2 instance type
m5.16xlarge. -
Remove the requirement for SSH fingerprints in
ghe-migratorarchives as it can always be computed. -
GitHub App Manifests now include the
request_oauth_on_installfield.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.17
DownloadSeptember 22, 2020
-
MEDIUM: ImageMagick has been updated to address DSA-4715-1.
-
Packages have been updated to the latest security versions.
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.
Enterprise Server 2.20.16
DownloadSeptember 07, 2020
-
A service health check caused session growth resulting in filesystem inode exhaustion.
-
Upgrading using a hotpatch could fail with an error:
'libdbi1' was not found
-
On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.
-
Custom firewall rules are not maintained during an upgrade.
-
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
-
Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.
-
When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
-
Security alerts are not reported when pushing to a repository on the command line.