Chef 0.10.2 and 0.9.18 released!

Chef 0.10.2 and 0.9.18 have been released on RubyGems. This is a critical security update to Chef Server and it is recommended that all open-source Chef Server users upgrade as soon as possible. Users of Opscode’s Hosted Chef and Private Chef are not affected. For those unable to upgrade the patch is available on GitHub.

The issue (CHEF-2436) being patched is that non-admin clients in the open-source server were able to upload and delete cookbooks. This could potentially allow privilege escalation in an already compromised network. No known exploits exist at this time.

Chef 0.10.2 contains only the relevant security fix. Chef 0.9.18 contains the security fix as well as the following bug fixes:

• CHEF-2234: dpkg package provider ignores ~ in versions
• CHEF-2129: Old zypper versions will crash because they don’t know the command line arguments
• CHEF-2367: Support multiple lines in DAEMONS list in rc.conf on Arch linux
• CHEF-2274: Shef does not seem to include the chef libraries