chef vulnerabilities

Products

• automate 1
• chef 1
• chef manage 1
• inspec 1

Latest chef CVEs

Newest publication first

1. CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

   Published 2023-10-31

   High·CVSS 8.8

   Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.

2. CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

   Published 2023-10-31

   Critical·CVSS 9.9

   Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

3. CVE-2015-8559 The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.

   Published 2017-09-21

   High·CVSS 7.5

   The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.

4. CVE-2016-4326 The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.

   Published 2016-06-10

   Critical·CVSS 9.8

   The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.