Skip to content

Commit d92c73a

Browse files
docs-botdocs-bot
authored
Merge pull request #33067 from github/repo-sync
Repo sync
2 parents f50aaf6 + d8748ac commit d92c73a

File tree

5 files changed

+172
-2
lines changed

5 files changed

+172
-2
lines changed

‎data/release-notes/enterprise-server/3-10/12.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
date: '2024-05-20'
2+
intro: |
3+
{% warning %}
4+
5+
**Warning**: A change to MySQL in GitHub Enterprise Server 3.9 and later may impact the performance of your instance. Before you upgrade, make sure you've read the "[Known issues](#3.10.12-known-issues)" section of these release notes.
6+
7+
{% endwarning %}
8+
sections:
9+
security_fixes:
10+
- |
11+
**CRITICAL**: On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges.
12+
13+
Please note that encrypted assertions are not enabled by default. Instances not utilizing SAML SSO or utilizing SAML SSO authentication without encrypted assertions are not impacted. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. GitHub has requested CVE ID [CVE-2024-4985](https://nvd.nist.gov/vuln/detail/CVE-2024-4985) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
14+
15+
For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise)" and "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions)."
16+
known_issues:
17+
- |
18+
Custom firewall rules are removed during the upgrade process.
19+
- |
20+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
21+
- |
22+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
23+
- |
24+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
25+
- |
26+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
27+
- |
28+
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-mysql-cannot-start-up %}
29+
- |
30+
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-io-utilization-increase %}
31+
- |
32+
{% data reusables.release-notes.2023-08-mssql-replication-known-issue %}
33+
- |
34+
{% data reusables.release-notes.2023-09-config-apply-timeout-hookshot-go-replicas %}
35+
- |
36+
After an administrator enables maintenance mode from the instance's Management Console UI using Firefox, the administrator is redirected to the Settings page, but maintenance mode is not enabled. To work around this issue, use a different browser.
37+
- |
38+
{% data reusables.release-notes.2023-11-aws-system-time %}
39+
- |
40+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
41+
- |
42+
{% data reusables.release-notes.2023-10-git-push-made-but-not-registered %}
43+
- |
44+
{% data reusables.release-notes.2023-10-actions-upgrade-bug %}
45+
- |
46+
{% data reusables.release-notes.large-adoc-files-issue %}
47+
- |
48+
{% data reusables.release-notes.2023-12-backup-utils-exit-early-redis %}
49+
- |
50+
{% data reusables.release-notes.2024-01-haproxy-upgrade-causing-increased-errors %}
51+
- |
52+
{% data reusables.release-notes.2024-02-pages-deployment-error %}

‎data/release-notes/enterprise-server/3-11/10.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
date: '2024-05-20'
2+
sections:
3+
security_fixes:
4+
- |
5+
**CRITICAL**: On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges.
6+
7+
Please note that encrypted assertions are not enabled by default. Instances not utilizing SAML SSO or utilizing SAML SSO authentication without encrypted assertions are not impacted. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. GitHub has requested CVE ID [CVE-2024-4985](https://nvd.nist.gov/vuln/detail/CVE-2024-4985) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
8+
9+
For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise)" and "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions)."
10+
known_issues:
11+
- |
12+
Custom firewall rules are removed during the upgrade process.
13+
- |
14+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
15+
- |
16+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
17+
- |
18+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
19+
- |
20+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
21+
- |
22+
{% data reusables.release-notes.2023-11-aws-system-time %}
23+
- |
24+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
25+
- |
26+
{% data reusables.release-notes.2023-10-git-push-made-but-not-registered %}
27+
- |
28+
{% data reusables.release-notes.large-adoc-files-issue %}
29+
- |
30+
{% data reusables.release-notes.2023-12-backup-utils-exit-early-redis %}
31+
- |
32+
{% data reusables.release-notes.2024-01-haproxy-upgrade-causing-increased-errors %}
33+
- |
34+
{% data reusables.release-notes.2024-02-pages-deployment-error %}
35+
- |
36+
Repositories originally imported using ghe-migrator will not correctly track Advanced Security contributions.

‎data/release-notes/enterprise-server/3-12/4.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
date: '2024-05-20'
2+
sections:
3+
security_fixes:
4+
- |
5+
**CRITICAL**: On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges.
6+
7+
Please note that encrypted assertions are not enabled by default. Instances not utilizing SAML SSO or utilizing SAML SSO authentication without encrypted assertions are not impacted. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. GitHub has requested CVE ID [CVE-2024-4985](https://nvd.nist.gov/vuln/detail/CVE-2024-4985) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
8+
9+
For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise)" and "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions)."
10+
known_issues:
11+
- |
12+
Custom firewall rules are removed during the upgrade process.
13+
- |
14+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
15+
- |
16+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
17+
- |
18+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
19+
- |
20+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
21+
- |
22+
{% data reusables.release-notes.2023-11-aws-system-time %}
23+
- |
24+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
25+
- |
26+
{% data reusables.release-notes.large-adoc-files-issue %}
27+
- |
28+
{% data reusables.release-notes.2023-12-backup-utils-exit-early-redis %}
29+
- |
30+
{% data reusables.release-notes.2024-02-pages-deployment-error %}
31+
- |
32+
Repositories originally imported using ghe-migrator will not correctly track Advanced Security contributions.

‎data/release-notes/enterprise-server/3-9/15.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
date: '2024-05-20'
2+
intro: |
3+
{% warning %}
4+
5+
**Warning**: A change to MySQL in GitHub Enterprise Server 3.9 and later may impact the performance of your instance. Before you upgrade, make sure you've read the "[Known issues](#3.9.15-known-issues)" section of these release notes.
6+
7+
{% endwarning %}
8+
sections:
9+
security_fixes:
10+
- |
11+
**CRITICAL**: On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges.
12+
13+
Please note that encrypted assertions are not enabled by default. Instances not utilizing SAML SSO or utilizing SAML SSO authentication without encrypted assertions are not impacted. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. GitHub has requested CVE ID [CVE-2024-4985](https://nvd.nist.gov/vuln/detail/CVE-2024-4985) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/).
14+
15+
For more information, see "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise)" and "[AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions)."
16+
known_issues:
17+
- |
18+
Custom firewall rules are removed during the upgrade process.
19+
- |
20+
During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start.
21+
- |
22+
If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)."
23+
- |
24+
If an instance is configured to forward logs to a target server with TLS enabled, certificate authority (CA) bundles that a site administrator uploads using `ghe-ssl-ca-certificate-install` are not respected, and connections to the server fail.
25+
- |
26+
When running `ghe-config-apply`, the process may stall with the message `Deployment is running pending automatic promotion`.
27+
- |
28+
The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning.
29+
- |
30+
When enabling CodeQL via default setup [at scale](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-at-scale), some checks related to GitHub Actions are omitted, potentially preventing the process from completing.
31+
- |
32+
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-mysql-cannot-start-up %}
33+
- |
34+
{% data reusables.release-notes.upgrade-to-3-9-or-to-3-10-io-utilization-increase %}
35+
- |
36+
{% data reusables.release-notes.2023-08-mssql-replication-known-issue %}
37+
- |
38+
{% data reusables.release-notes.2023-09-config-apply-timeout-hookshot-go-replicas %}
39+
- |
40+
{% data reusables.release-notes.2023-11-aws-system-time %}
41+
- |
42+
On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1.
43+
- |
44+
{% data reusables.release-notes.2023-10-git-push-made-but-not-registered %}
45+
- |
46+
{% data reusables.release-notes.2023-10-actions-upgrade-bug %}
47+
- |
48+
{% data reusables.release-notes.2023-12-backup-utils-exit-early-redis %}
49+
- |
50+
{% data reusables.release-notes.2024-01-haproxy-upgrade-causing-increased-errors %}
51+
- |
52+
{% data reusables.release-notes.2024-02-pages-deployment-error %}

‎data/reusables/security/compliance-report-list.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,5 @@
22
- SOC 2, Type 2
33
- Cloud Security Alliance CAIQ self-assessment (CSA CAIQ - Level 1)
44
- ISO/IEC 27001:2013 certification
5-
- ISO/IEC 27701:2019 (Processor) certification
6-
- ISO/IEC 27018:2019 certification
75
- Cloud Security Alliance STAR certification (CSA STAR - Level 2)
86
- {% data variables.product.prodname_dotcom_the_website %} Services Continuity and Incident Management Plan

0 commit comments

Comments
 (0)