Chef

chef

6 CVEs • 4 products

Products (4)

Click to collapse

Toggle

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-8868 1Chef 1Automate Oct 16, 2025 Sep 29, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized...Show more In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.Show less
CVE-2025-6724 1Chef 1Automate Oct 16, 2025 Sep 29, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs...Show more In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.Show less
CVE-2023-42658 1Chef 1Inspec Jun 17, 2026 Oct 31, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
CVE-2023-40050 1Chef 1Automate Jun 17, 2026 Oct 31, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.
CVE-2015-8559 1Chef 1Chef May 13, 2026 Sep 21, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.
CVE-2016-4326 1Chef 1Chef Manage May 6, 2026 Jun 10, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.