The 2.1 series release notes contain important changes in this release series.

Security Fixes

• HIGH OpenSSH packages have been updated to address multiple vulnerabilities.
• MED libxml2 and related packages have been updated to address multiple vulnerabilities.
• MED rsync has been updated to address a recently identified vulnerability.
• LOW Passwords and two-factor one-time passwords could be written to the exceptions log.
• Packages have been updated to the latest security versions.

Known Issues

• Management console sessions can expire too quickly for Safari users.

• Promoting a high availability replica can fail if Elasticsearch takes too long to restart.

• A high availability replica that's been promoted to primary and then set up as a replica again doesn't properly show the replica status page, but shows 'Starting...' instead.

• Some processes continued to write to logs after they were rotated. This could cause the root file system to fill up.

• Gist profile pages don't have proper styling when subdomain isolation disabled.

• SNMP can't be run on high availability replicas.

• Custom firewall rules aren't maintained during an upgrade.

• Deleting a user doesn't delete their gists, which can cause problems with replication.

• In our instructions to merge a pull request on the command line, we show the steps to merge using the Git protocol even when private mode is on. Private mode forces authentication but the Git protocol is unauthenticated so the steps will always fail. We also don't show the steps to merge using SSH.

• Accessing GitHub Enterprise using a hostname alias with private mode enabled as an unauthenticated user will redirect you to the dashboard instead of the page you were trying to visit after you log in.

• We display the time in the scheduled maintenance banner in UTC instead of the viewer's timezone.

• Users with LDAP DNs longer than 255 characters are suspended if LDAP Sync is enabled.

• Images uploaded to issues save with an absolute URL, so they can be broken if the hostname changes.

• With private mode enabled, a Pages site with no default page serves a generic error rather than an informative message.

• HIGH (CVE-2015-7547) 2.1 is vulnerable to glibc getaddrinfo stack-based buffer overflow. To manually patch your appliance, apply the hotfix by connecting to your appliance via SSH and running these commands: (updated 2016-02-17)

  $ curl -O https://github-enterprise.s3.amazonaws.com/patches/github-enterprise-libc-precise.hpkg
  $ md5sum github-enterprise-libc-precise.hpkg # c068256696f2775579e2cd8223f82306
  $ chmod +x github-enterprise-libc-precise.hpkg
  $ ./github-enterprise-libc-precise.hpkg
  

Upcoming deprecation of GitHub Enterprise 2.1

GitHub Enterprise 2.1 will be deprecated as of April 4, 2016. That means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, upgrade to the newest version of GitHub Enterprise as soon as possible.

Thanks!

The GitHub Team