From 017b4e68df3768f054add608e66ea22387978296 Mon Sep 17 00:00:00 2001 From: Vanessa Date: Tue, 26 Nov 2024 10:33:02 +1000 Subject: [PATCH 1/2] Update hubber-contribution-help.yml / check-team-membership (pull_request) workflow (#53297) --- .github/workflows/hubber-contribution-help.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/hubber-contribution-help.yml b/.github/workflows/hubber-contribution-help.yml index 0df92207b0f2..e3896a713088 100644 --- a/.github/workflows/hubber-contribution-help.yml +++ b/.github/workflows/hubber-contribution-help.yml @@ -48,7 +48,7 @@ jobs: **🛎️ Is this PR ready for review?** A PR is ready for a docs review _after_ the self-review checklist is complete. - When this is ready for review, add the **\`ready-for-doc-review\`** label to this PR. The PR will then be automatically added to the [Docs Content review board](https://github.com/orgs/github/projects/2936). _Please allow at least 3 working days for a review, and longer if this is a substantial change._ + When this is ready for review, add the **\`ready-for-doc-review\`** label to this PR. The PR will then be automatically added to the [Docs Content review board](https://github.com/orgs/github/projects/2936). _Please allow at least 3 working days for a review, and longer if this is a substantial change._" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 0ff886bb7ddea281a94ae23837ec57c66362b33a Mon Sep 17 00:00:00 2001 From: Daniel Johnson Date: Mon, 25 Nov 2024 16:44:46 -0800 Subject: [PATCH 2/2] Removes 3.10.19 release notes (#53296) Co-authored-by: Vanessa --- .../enterprise-server/3-10/19.yml | 34 ------------------- 1 file changed, 34 deletions(-) delete mode 100644 data/release-notes/enterprise-server/3-10/19.yml diff --git a/data/release-notes/enterprise-server/3-10/19.yml b/data/release-notes/enterprise-server/3-10/19.yml deleted file mode 100644 index 7ac6e1e21477..000000000000 --- a/data/release-notes/enterprise-server/3-10/19.yml +++ /dev/null @@ -1,34 +0,0 @@ -date: '2024-11-07' -sections: - security_fixes: - - | - **HIGH**: An attacker could bypass SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, allowing unauthorized provisioning of users and access to the instance, by exploiting an improper verification of cryptographic signatures vulnerability in GitHub Enterprise Server. This is a follow up fix for [CVE-2024-9487](https://www.cve.org/cverecord?id=CVE-2024-9487) to further harden the encrypted assertions feature against this type of attack. Please note that encrypted assertions are not enabled by default. Instances not utilizing SAML SSO, or utilizing SAML SSO authentication without encrypted assertions, are not impacted. Additionally, an attacker would require direct network access as well as a signed SAML response or metadata document to exploit this vulnerability. - known_issues: - - | - Custom firewall rules are removed during the upgrade process. - - | - During the validation phase of a configuration run, a `No such object` error may occur for the Notebook and Viewscreen services. This error can be ignored as the services should still correctly start. - - | - If the root site administrator is locked out of the Management Console after failed login attempts, the account does not unlock automatically after the defined lockout time. Someone with administrative SSH access to the instance must unlock the account using the administrative shell. For more information, see "[AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console/troubleshooting-access-to-the-management-console#unlocking-the-root-site-administrator-account)." - - | - The `mbind: Operation not permitted` error in the `/var/log/mysql/mysql.err` file can be ignored. MySQL 8 does not gracefully handle when the `CAP_SYS_NICE` capability isn't required, and outputs an error instead of a warning. - - | - {% data reusables.release-notes.2023-11-aws-system-time %} - - | - On an instance with the HTTP `X-Forwarded-For` header configured for use behind a load balancer, all client IP addresses in the instance's audit log erroneously appear as 127.0.0.1. - - | - {% data reusables.release-notes.2023-10-git-push-made-but-not-registered %} - - | - {% data reusables.release-notes.large-adoc-files-issue %} - - | - {% data reusables.release-notes.2024-01-haproxy-upgrade-causing-increased-errors %} - - | - The `reply.[HOSTNAME]` subdomain is falsely always displaying as having no SSL and DNS record, when testing the domain settings via the Management Console without subdomain isolation. - - | - Admin stats REST API endpoints may timeout on appliances with many users or repositories. Retrying the request until data is returned is advised. - - | - {% data reusables.release-notes.2024-06-possible-frontend-5-minute-outage-during-hotpatch-upgrade %} - - | - When restoring from a backup snapshot, a large number of `mapper_parsing_exception` errors may be displayed. - - | - Services may respond with a `503` status due to an out of date `haproxy` configuration. This can usually be resolved with a `ghe-config-apply` run.