The 2.3 series release notes contain important changes in this release series.

Bug Fixes

• High availability replication could fail to automatically start after a reboot.

Security Fixes

• HIGH An integer overflow in Git could result in incorrect memory allocation values (CVE-2016-2315, CVE-2016-2324). (updated 2016-03-17)
• MED libxml2 and related packages have been updated to address multiple vulnerabilities.
• MED OpenSSL packages have been updated to address multiple vulnerabilities.
• LOW Auto-completion within several fields of the management console settings could cause SNMP and LDAP secrets to be logged in plaintext.
• Packages have been updated to the latest security versions.

Known Issues

• We incorrectly redirect to the dashboard if you accessed GitHub Enterprise using an alias while in private mode. This might happen if you set a fully qualified domain name but the subdomain resolves correctly.
• Email can't be sent over TLS when SSL is disabled.
• Deleting a user doesn't delete their gists, which can cause problems with replication.
• Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.
• On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
• The management console settings interface doesn't clearly show if you have previously uploaded certificate files or a private key.
• Management console sessions can expire too quickly for Safari users.
• Gist repositories are not garbage collected by the maintenance scheduler.
• Custom firewall rules aren't maintained during an upgrade.
• Repositories that are in an incomplete state, which is a rare problem, can cause the migration to the new repository disk layout to fail.
• Enqueued background jobs are sometimes not purged when a repository is deleted.
• When a fork is detached from its repository network by an administrator or by changing visibility, its filesystem path won't be updated on a high availability replica until at least one commit has been pushed.
• Viewing raw files in repositories owned by a user or organization named "github" fails with a 400 error. (updated 2015-12-15)
• Trying to add a file to a repository with Subversion 1.9 clients incorrectly detects the file already exists and fails. (updated 2016-01-14)

Git LFS Client Vulnerability

An issue has been identified that could allow an attacker to execute arbitrary commands on a user’s computer if they had Git LFS installed and cloned a malicious repository. Git LFS supports a per-repository configuration file to customize how certain aspects of Git LFS function. However, this file also allowed arbitrary Git configuration options to be modified. We have addressed the vulnerability by whitelisting the set of per-repository Git LFS configuration options that can be used to a safe subset.

GitHub Enterprise is not directly affected as this is a client-side vulnerability and Git LFS is disabled on GitHub Enterprise by default. If you have enabled Git LFS on your appliance, we recommend you upgrade your clients to Git LFS 1.0.1 or later to address this vulnerability.

Thanks!

The GitHub Team