[chef-dev] Rack vulnerabilities in chef-server-webui in Chef Server 11

[Bryan McLellan < >]

We believe that the chef-server-webui in Chef Server 11 is vulnerable to 
recently announced security vulnerabilities in Rack [1]. The Chef 10 webui 
does not run on rails. We recommend that Chef 11 Server users shut down the 
webui to prevent any expoitation.

To do so, create '/etc/chef-server/chef-server.rb' and add this line to it:

webui_enable false

Then run 'sudo chef-server-ctl reconfigure'

On Monday we will release a new Chef Server 11 package that upgrades Rack to 
1.4.5 to resolve this issue. The webui will be configured to not start by 
default in Monday's release and subsequent releases and we are deprecating 
it. The chef-server-webui will not be included in the Chef 12 Server 
open-source release.

---
Bryan McLellan | opscode | technical program manager, open source
(c) 206.607.7108 | (t) @btmspox | (b) http://blog.loftninjas.org

[1] http://rack.github.com/