GitHub Enterprise Server Vulnerabilities Response: patches released

Enterprise Server/Unified SKU Customers:

Due to the critical nature of the vulnerabilities identified in Rails, we strongly urge customers immediately upgrade their GitHub Enterprise Server appliance to the latest patch release in their series, GitHub Enterprise Server 2.13.22, 2.14.16, 2.15.9, 2.16.4, or greater.

If you have any questions, please contact GitHub support at https://enterprise.github.com/support.

The full release notes are available at:

https://enterprise.github.com/releases/2.16.4/notes https://enterprise.github.com/releases/2.15.9/notes

https://enterprise.github.com/releases/2.14.16/notes https://enterprise.github.com/releases/2.13.22/notes

Common Vulnerability and Exposure (CVE) references have been issued for the vulnerabilities:

• CRITICAL: A specially crafted request could allow arbitrary files to be read and the file content to be disclosed. For more information see the associated Rails CVE: CVE-2019-5418
• HIGH: High CPU usage could be triggered by a specially crafted request resulting in Denial of Service (DoS). For more information see the associated Rails CVE: CVE-2019-5419