355 matches found
CVE-2019-1003087: Missing Authorization
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
GHSA-G982-9R8G-6QXW Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
There is a /tmp file race condition in chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 when creating /tmp/perlbrew-installer. If a malicious local user creates the file first they can overwrite the contents with their own code executing it as the ciborg...
fuddruckers.net-chef.com XSS vulnerability
Open Bug Bounty ID: OBB-645924 Description| Value ---|--- Affected Website:| fuddruckers.net-chef.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2012-0433
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
CVE-2012-0433 insecure permissions on files containing confidential data
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
CVE-2012-0433: Incorrect Permission Assignment for Critical Resource
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
Cooking Up Shells with Chef
I was able to compromise a Chef server on one of my recent engagements. Owning a Chef server means having the keys to the castle. I wasnt quite sure how to go about using this tool. Im familiar with Puppet as Ive spent the majority of my career on the systems side. Having never run into Chef, I...
Copy-Paste Vulnerability Through LibXML2
Nokogiri and Chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to CVE-2017-15412 - LibXML2 contains a use-after-free bug in the xmlXPathCompOpEvalPositionPredicate method in xpath.c...
CVE-2014-5003
chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer...
Copy-paste Vulnerability Through LibXML2
Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...
Chef Information Disclosure Vulnerability
Chef is written by Ruby form management software , it is a pure Ruby domain-specific language DSL to save the system configuration "recipes recipes" or "cookbook cookbooks". chef Developed by Opscode , and released under the Apache protocol version 2.0 open source . A security vulnerability exist...
Information Disclosure
chef is vulnerable to information disclosure. When you knife bootstrap a node, the validation key is printed into the logs found at /var/log/messages...
Chef Software Directory Traversal Vulnerability
Chef Software is a set of server application configuration tools written in Ruty and Erlang by Chef Software. mixlib-archive is one of the gem extraction archive tools. A directory traversal vulnerability exists in Chef Software in versions 0.3.0 and earlier of mixlib-archive. A remote attacker c...
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
Design/Logic Flaw
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
UBUNTU-CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
CVE-2015-8559
The CVE-2015-8559 issue affects Chef Infra Client’s knife bootstrap command, where versions before 15.4.45 leak the validator.pem private RSA key to /var/log/messages. This exposes sensitive credentials and constitutes an information disclosure vulnerability. Affected component: knife bootstrap i...
