The 2.2 series release notes contain important changes in this release series.
Security Fixes
Remote Code Execution in ImageMagick
Several vulnerabilities in ImageMagick, a package commonly used by web services to process images, have been discovered and disclosed by members of the Mail.ru Security team. One of the vulnerabilities is critical and can lead to remote code execution when processing user submitted images.
Final patches for all the disclosed vulnerabilities within ImageMagick are still pending. This release mitigates the remote code execution vulnerability by implementing the recommended policy to disable the vulnerable ImageMagick coders.
This vulnerability exists in ImageMagick but there is no evidence that it has been exploited on GitHub Enterprise.
We strongly recommend that all GitHub Enterprise customers upgrade their instances as soon as possible.
Mitigation
If you can't immediately upgrade, the issue can be mitigated by implementing the policy changes as follows:
-
SSH to your GitHub Enterprise appliance.
-
Edit the /etc/ImageMagick/policy.xml file:
sudo vi /etc/ImageMagick/policy.xml
-
Disable the vulnerable coders by replacing the <policymap> section with:
<policymap>
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
</policymap>
There is no need to reboot or restart any services; the changes will take effect immediately.
Please contact GitHub Enterprise Support if you have any questions.
Bug Fixes
- Memcached didn't log warnings or errors.
Known Issues
- Repositories that are in an incomplete state, which is a rare problem, can cause the migration to the new repository disk layout to fail.
- Enqueued background jobs are sometimes not purged when a repository is deleted.
- Organization invitation emails are sent from the configured support email address rather than the no-reply address.
- We can fail to properly create the key for the secure connection between a high availability replica and the primary, which causes replication setup to fail.
- Management console sessions can expire too quickly for Safari users.
- Gist repositories are not garbage collected by the maintenance scheduler.
- Gist profile pages don't have proper styling when subdomain isolation is disabled.
- Custom firewall rules aren't maintained during an upgrade.
- Dashboard activity feed links point to wrong hostname after restoring from backup if the hostname has changed.
- On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
- Jobs stuck on code indexing can delay other jobs from running.
- Replication setup fails for IPv6 hosts.
- The management console settings interface doesn't clearly show if you have previously uploaded certificate files or a private key.
- Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.
- Gists can't be created when using Safari 8.x in Private Mode.
- Deleting a user doesn't delete their gists, which can cause problems with replication.
- In our instructions to merge a pull request on the command line, we show the steps to merge using the Git protocol even when private mode is on. Private mode forces authentication but the Git protocol is unauthenticated so the steps will always fail. We also don't show the steps to merge using SSH.
- We incorrectly redirect to the dashboard if you access GitHub Enterprise using an alias while in private mode. This might happen if you set a fully qualified domain name but the subdomain resolves correctly.
- We display the time in the scheduled maintenance banner in UTC instead of the viewer's timezone.
- Users with LDAP DNs longer than 255 characters are suspended if LDAP Sync is enabled.
- Viewing raw files in repositories owned by a user or organization named "github" fails with a 400 error.
Thanks!
The GitHub Team