305 matches found
CVE-2012-0433
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
CVE-2012-0433 insecure permissions on files containing confidential data
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data...
Cooking Up Shells with Chef
I was able to compromise a Chef server on one of my recent engagements. Owning a Chef server means having the keys to the castle. I wasnt quite sure how to go about using this tool. Im familiar with Puppet as Ive spent the majority of my career on the systems side. Having never run into Chef, I...
Copy-Paste Vulnerability Through LibXML2
Nokogiri and Chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to CVE-2017-15412 - LibXML2 contains a use-after-free bug in the xmlXPathCompOpEvalPositionPredicate method in xpath.c...
CVE-2014-5003
chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer...
Copy-paste Vulnerability Through LibXML2
Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...
Chef Information Disclosure Vulnerability
Chef is written by Ruby form management software , it is a pure Ruby domain-specific language DSL to save the system configuration "recipes recipes" or "cookbook cookbooks". chef Developed by Opscode , and released under the Apache protocol version 2.0 open source . A security vulnerability exist...
Information Disclosure
chef is vulnerable to information disclosure. When you knife bootstrap a node, the validation key is printed into the logs found at /var/log/messages...
Chef Software Directory Traversal Vulnerability
Chef Software is a set of server application configuration tools written in Ruty and Erlang by Chef Software. mixlib-archive is one of the gem extraction archive tools. A directory traversal vulnerability exists in Chef Software in versions 0.3.0 and earlier of mixlib-archive. A remote attacker c...
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
UBUNTU-CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
Design/Logic Flaw
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
CVE-2015-8559
The CVE-2015-8559 issue affects Chef Infra Client’s knife bootstrap command, where versions before 15.4.45 leak the validator.pem private RSA key to /var/log/messages. This exposes sensitive credentials and constitutes an information disclosure vulnerability. Affected component: knife bootstrap i...
CVE-2015-8559
Removed by vendor...
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages...
Debian DSA-3915-1 : ruby-mixlib-archive - security update
It was discovered that ruby-mixlib-archive, a Chef Software's library used to handle various archive formats, was vulnerable to a directory traversal attack. This allowed attackers to overwrite arbitrary files by using a malicious tar archive containing '..' in its entries. %NASLMINLEVEL 70300 C...
[SECURITY] [DSA 3915-1] ruby-mixlib-archive security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3915-1 [email protected] https://www.debian.org/security/ Sebastien Delafond July 20, 2017 https://www.debian.org/security/faq -...
Debian Security Advisory DSA 3915-1 (ruby-mixlib-archive - security update)
It was discovered that ruby-mixlib-archive, a Chef Software OpenVAS Vulnerability Test $Id: deb3915.nasl 6800 2017-07-26 06:58:22Z cfischer $ Auto-generated from advisory DSA 3915-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2017 Greenbone Networks GmbH...