# Supermarket 3.1.51 released!

**URL:** <https://discourse.chef.io/t/supermarket-3-1-51-released/12330>\
**Category:** Chef Release Announcements\
**Created:** [December 18, 2017, 9:36pm UTC](https://discourse.chef.io/t/supermarket-3-1-51-released/12330 "2017-12-18T21:36:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![robbkidd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/robbkidd/32/2101_2.png) [@robbkidd](https://discourse.chef.io/u/robbkidd)\
**Post date:** [December 18, 2017, 9:36pm UTC](https://discourse.chef.io/t/supermarket-3-1-51-released/12330/1 "2017-12-18T21:36:57Z")

</div>

Supermarket 3.1.51 was released today and is available for download at [https://downloads.chef.io/supermarket](https://downloads.chef.io/supermarket). This release contains security updates and is a recommended upgrade.

#### Security Fixes

- upgrade version of omnibus-embedded nginx [#1706](https://github.com/chef/supermarket/pull/1706) ([robbkidd](https://github.com/robbkidd))
  - Addresses the following CVEs:
    - [CVE-2016-4450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4450) - denial of service via crafted request involving writing a client request body to a temporary file
    - [CVE-2016-0747](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0747) - denial of service via vectors related to name resolution
    - [CVE-2016-0746](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0746) - denial of service via crafted DNS response related to CNAME processing
    - [CVE-2016-0742](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0742) - denial of service via crafted UDP DNS response