GitHub Enterprise - The best way to build and ship software

GitHub Enterprise 2.12.3 January 16, 2018 Series notes · Download

The 2.12 series release notes contain important changes in this release series.

Meltdown

This release addresses the Meltdown (CVE-2017-5754) attack. This has been fixed in the 3.16.51-3+deb8u1 release from Debian. Please note that this patch does not address the Spectre (CVE-2017-5753 and CVE-2017-5715) vulnerability. A fix is not available for the Spectre vulnerability yet.

Internally conducted benchmarks indicate the performance impact is limited to a 2-5% increase in CPU usage on most platforms. The impact can vary depending on your usage and platform though. If you see a significant performance difference, don't hesitate to reach out to Enterprise Support.

Note on Hotpatching

The hotpatch contains an upgrade to the kernel and requires a reboot. The Meltdown attack is not fixed until a reboot is performed.

Security Fixes

HIGH: Kernel is updated to 3.16.51-3+deb8u1 which implements Kernel Page Table Isolation (KPTI) to address Meltdown.

Bug Fixes

ghe-dbconsole, in a cluster environment, did not work on nodes without a database role.
The ghe-repl-status command-line utility incorrectly showed TypeError: no implicit conversion of Symbol into Integer when there are repositories or gists with bad replica counts.
The ghe-dpages check-replicas command could show an error with widely dispersed geo replicas.

Known Issues

We incorrectly redirect to the dashboard if you accessed GitHub Enterprise using an alias while in private mode. This might happen if you set a fully qualified domain name but the subdomain resolves correctly.
Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.
On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
Custom firewall rules aren't maintained during an upgrade.
svn checkout may timeout while the repository data cache is being built. In most cases, subsequent svn checkout attempts will succeed.
Git LFS tracked files uploaded through the web interface are incorrectly added directly to the repository.
GitHub Enterprise clustering can not be configured without https.
Deleting a search index doesn't delete all associated metadata, which are then incorrectly reused if a new search index is created. This causes search index repair jobs to be reported as finished in the site admin when they were not.
GitHub Apps silently fail to be created when the name contains an underscore.
Pull request review comments migrated with ghe-migrator are displayed in the wrong order.
The pull request review request has users reversed, after migration with ghe-migrator.
The comment count in the "Conversation" tab of a pull request migrated with ghe-migrator can be wrong.
The create team API endpoint returns a 500 error if LDAP Sync is enabled and the team already exists.
Background job logging to /var/log/github/production.log may consume large amounts of disk space. The fast growth of this log file could cause the root disk to fill up.
Large API requests may trigger excessive logging in the exceptions log. (updated 2018-01-31)
The gpgverify service may consume large amounts of CPU time even when not processing requests. (updated 2018-02-14)
Pull request reviewer usernames were not updated if a reviewer was mapped to a different username when migrating repositories using ghe-migrator. (updated 2018-04-12)
On a repository that's been locked for migration using ghe-migrator, project boards are not exported. (updated 2018-05-07)
Nameid-format matching on SAML response is too strict when value is "unspecified", which can cause an error with the "Another user already owns the account." message if the IdP changes NameID. (updated 2018-06-25)

Thanks!