EUVD-2023-47091

Malicious code in bioql PyPI...

EUVD-2023-44657

Malicious code in bioql PyPI...

CVE-2023-42658

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-40050

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-42658

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

Remote code execution

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

Command injection

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-42658

CVE-2023-42658 affects Chef InSpec. Vulnerable in versions prior to 4.56.58 and 5.22.29 , where maliciously crafted profiles can trigger local command execution via the archive, check, and export commands. Remediation: upgrade to 4.56.58+ or 5.22.29+. See PT-2023-28487 for details on affected com...

CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

PT-2023-27237 · Chef · Chef Automate

Name of the Vulnerable Software and Affected Versions: Chef Automate versions prior to and including 4.10.29 Description: The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted...

CVE-2023-40050: Improper Control of Generation of Code

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

PT-2023-28487 · Chef · Chef Inspec

Name of the Vulnerable Software and Affected Versions: Chef InSpec versions prior to 4.56.58 Chef InSpec versions prior to 5.22.29 Description: The issue allows local command execution via maliciously crafted profiles, specifically affecting the archive, check, and export commands in Chef InSpec...

CVE-2023-42658: Improper Control of Generation of Code

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

Chef InSpec Code Injection Vulnerability

Chef Software Chef InSpec is an open source automated testing and compliance checking framework from Chef Software designed to help developers and operations teams write, run, and maintain automated test scripts to validate the compliance and security of applications and infrastructure. A securit...