Rack vulnerabilities in chef-server-webui in Chef Server 11


We believe that the chef-server-webui in Chef Server 11 is vulnerable to recently announced security vulnerabilities in Rack [1]. The Chef 10 webui does not run on rails. We recommend that Chef 11 Server users shut down the webui to prevent any expoitation.

To do so, create ‘/etc/chef-server/chef-server.rb’ and add this line to it:

webui_enable false

Then run ‘sudo chef-server-ctl reconfigure’

On Monday we will release a new Chef Server 11 package that upgrades Rack to 1.4.5 to resolve this issue. The webui will be configured to not start by default in Monday’s release and subsequent releases and we are deprecating it. The chef-server-webui will not be included in the Chef 12 Server open-source release.

Bryan McLellan | opscode | technical program manager, open source
© 206.607.7108 | (t) @btmspox | (b) http://blog.loftninjas.org

[1] http://rack.github.com/