Chef 0.10.2 and 0.9.18 have been released on RubyGems. This is a critical security update to Chef Server and it is recommended that all open-source Chef Server users upgrade as soon as possible. Users of Opscode’s Hosted Chef and Private Chef are not affected. For those unable to upgrade the patch is available on GitHub.
The issue (CHEF-2436) being patched is that non-admin clients in the open-source server were able to upload and delete cookbooks. This could potentially allow privilege escalation in an already compromised network. No known exploits exist at this time.
Chef 0.10.2 contains only the relevant security fix. Chef 0.9.18 contains the security fix as well as the following bug fixes: