The 2.22.9 patch is a high level security patch, which also fixes a handful of bugs.
Security Fixes
- HIGH: A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to override environment variables leading to code execution on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.3 and was fixed in 3.0.3, 2.22.9, and 2.21.17. This vulnerability was reported via the GitHub Bug Bounty program and has been assigned CVE-2021-22864.
- Packages have been updated to the latest security versions.
Bug Fixes
- A Security & Analysis link did not appear in the left-side navigation on the Settings page for repositories.
Due to the high severity security fixes, this patch will be applied off the usual schedule.
The update will be applied Thursday March 24th , 2021 at 5:00PM.
See the complete upgrade notes at GitHub Enterprise: https://enterprise.github.com/releases/2.22.9/notes
This upgrade also includes fixes from patch 2.22.8: https://enterprise.github.com/releases/2.22.8/notes