The 2.4 series release notes contain important changes in this release series.
ghe-ssl-ca-certificate-install. This could cause webhooks to fail as the certificates could not be read.
We incorrectly redirect to the dashboard if you accessed GitHub Enterprise using an alias while in private mode. This might happen if you set a fully qualified domain name but the subdomain resolves correctly.
Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.
On a freshly set up GitHub Enterprise without any users, an attacker could create the first admin user.
The management console settings interface doesn't clearly show if you have previously uploaded certificate files or a private key.
Custom firewall rules aren't maintained during an upgrade.
Enqueued background jobs are sometimes not purged when a repository is deleted.
Trying to add a file to a repository with Subversion 1.9 clients incorrectly detects the file already exists and fails.
On instances upgraded from 2.3 and earlier, restoring an archived protected branch will not restore all the settings correctly. This does not affect new instances.
HIGH (CVE-2015-7547) 2.4 is vulnerable to
glibc getaddrinfo stack-based buffer overflow. To manually patch your appliance, apply the hotfix by connecting to your appliance via SSH and running these commands: (updated 2016-02-17)
$ curl -O https://github-enterprise.s3.amazonaws.com/patches/github-enterprise-libc-precise.hpkg $ md5sum github-enterprise-libc-precise.hpkg # c068256696f2775579e2cd8223f82306 $ chmod +x github-enterprise-libc-precise.hpkg $ ./github-enterprise-libc-precise.hpkg
The GitHub Team