CVE-2023-42658

CVE-2023-42658 affects Chef InSpec. Vulnerable in versions prior to 4.56.58 and 5.22.29 , where maliciously crafted profiles can trigger local command execution via the archive, check, and export commands. Remediation: upgrade to 4.56.58+ or 5.22.29+. See PT-2023-28487 for details on affected com...

CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050

CVE-2023-40050 affects Chef Automate versions prior to and including 4.10.29. A remote code execution flaw exists when uploading a profile through the API or the user interface using the InSpec check command with a maliciously crafted profile. Affected component is the profile upload pathway in C...

PT-2023-28487 · Chef · Chef Inspec

Name of the Vulnerable Software and Affected Versions: Chef InSpec versions prior to 4.56.58 Chef InSpec versions prior to 5.22.29 Description: The issue allows local command execution via maliciously crafted profiles, specifically affecting the archive, check, and export commands in Chef InSpec...

PT-2023-27237 · Chef · Chef Automate

Name of the Vulnerable Software and Affected Versions: Chef Automate versions prior to and including 4.10.29 Description: The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted...

Chef InSpec Code Injection Vulnerability

Chef Software Chef InSpec is an open source automated testing and compliance checking framework from Chef Software designed to help developers and operations teams write, run, and maintain automated test scripts to validate the compliance and security of applications and infrastructure. A securit...

Chef Automate Code Injection Vulnerability

Chef Software Chef Automate is an automation platform from Chef Software for automating and managing infrastructure, applications, and compliance to help organizations achieve continuous delivery, automated operations, and security compliance. A security vulnerability exists in Chef Automate...

chefsimonskitchen.com Cross Site Scripting vulnerability OBB-3597557

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Information Disclosure

chef-identity is vulnerable to Information Disclosure. The vulnerability exists because ChefIdentityBuildWrapper.xml does not properly mask the user.pem key on the form field, allowing an attacker to gain sensitive information if they have access to the global configuration file, or are able to...

GHSA-5JC5-M87X-88FJ Secret displayed without masking by Chef Identity Plugin

Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration. While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form do...

Secret displayed without masking by Chef Identity Plugin

Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration. While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form do...

CVE-2023-39155

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

CVE-2023-39155

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

Design/Logic Flaw

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

CVE-2023-39155

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

CVE-2023-39155

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...

CVE-2023-39155

The CVE-2023-39155 entry affects Jenkins Chef Identity Plugin (versions 2.0.3 and earlier). The root cause is that the user.pem key form field in the plugin’s global configuration is not masked, allowing an attacker with access to the Jenkins controller UI to observe or capture the key. This is t...