Chef Infra Server 15.10.125 Released!

Chef Release Announcements
1

We are delighted to announce the availability of Chef Infra Server 15.10.125.

Security

  • Removed stale Rack and REXML gem directories that could be left on disk by the package manager during upgrades.
    chef-server-ctl reconfigure now removes gem versions below the required minimum versions. This addresses the following CVEs, which could be flagged during vulnerability scans even though the affected gems were not actively loaded:
    • CVE-2025-61772 (Rack multipart denial-of-service, fixed in Rack 3.2.2 and later)
    • CVE-2026-22860 (Rack::Directory path traversal, fixed in Rack 3.2.5 and later)
    • CVE-2026-25500 (Rack::Directory cross-site scripting, fixed in Rack 3.2.5 and later)
  • Defined minimum versions for net-imap, rack, and rexml in the oc-id, chef-server-ctl, and oc-chef-pedant Gemfiles.
    These minimum versions are defined in a shared safe_versions.rb constant, creating a single source of truth and preventing vulnerable gem versions from being included in package installations or bundle updates.
    (#4227)

Service versions

This release uses:

  • OpenResty 1.31.1.1
  • OpenJRE 17.0.9+9
  • PostgreSQL 13.23.tuxcare.1.0.0
  • OpenSearch 1.3.20-tuxcare-1.0.3
  • Rack 3.2.5
  • Valkey 7.2.11