CVE-2017-1000026

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries...

Directory traversal

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries...

CVE-2017-1000026

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries...

CVE-2017-1000026

CVE-2017-1000026 affects Chef Software’s Ruby library mixlib-archive (versions ≤ 0.3.0). A directory traversal flaw allows an attacker to overwrite arbitrary files by placing .. in tar archive entries. The vulnerability impact is demonstrated in multiple advisories; Debian fixed it in ruby-mixlib...

CVE-2017-1000026

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries...

CVE-2017-1000026

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries...

DevOps: Vagrant with AWS EC2 & Digital Ocean

The Benefits of Vagrant Plugins Following on from my recent DevOps blog posts, The DevOps Tools We Use & How We Use Them and Vagrant with Chef-Server, we will take another step forward and look into provisioning our servers in the cloud. There are many cloud providers out there, most who provide...

Friday Squid Blogging: Squid and Chips

The excellent Montreal chef Marc-Olivier Frappier, of Joe Beef fame, has created a squid and chips dish for Brit & Chips restaurant. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Unspecified Vulnerability in SaltStack

SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions, able to manage tens of thousands of servers, with the ability to quickly complete the data transfer. A...

UBUNTU-CVE-2015-1839

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp...

Insecure Installation Defaults

chef is vulnerable to insecure installation defaults. The library by default installs packages without checking the package's gpg signature. This can allow a malicious user to easily install a malicious package on to the system...

Chef Manage Remote Code Execution Vulnerability

Chef is a management system for IT professionals and provides configuration management and automation capabilities for the entire infrastructure from Chef Software, U.S.A. Chef Manage is an enterprise-grade Chef plug-in that visualizes and manages nodes, packets, roles, environments, and role-bas...

Chef Manage Detection

Detection of Chef Manage The script sends a HTTP connection request to the server and attempts to detect the presence of Chef Manage and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

Chef Manage RCE Vulnerability

Chef Manage is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-7174

The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5...

CVE-2017-7174

The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5...

Design/Logic Flaw

The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5...

CVE-2017-7174

CVE-2017-7174 affects Chef Manage, specifically the user-account creation feature in versions 2.1.0–2.4.4. Multiple sources describe a remote code execution vulnerability that can be exploited by remote attackers to run arbitrary code, with a fixed update available in version 2.4.5. The NVD entry...

CVE-2017-7174

The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5...

OWASP Security Knowledge Framework - An expert system application that uses OWASP Application Security Verification Standard

Security Knowledge Framework is an expert system application that uses OWASP Application Security Verification Standard, code examples, helps developers in pre-development and post-development. Introduction Our experience taught us that the current level of security the current web-applications...