[chef-dev] [release-announce] Security Releases: Chef Server, Enterprise Chef Server, and Analytics

[Marc Paradise < >]

[Second sending to cover the chef-dev list, omitted from the first.]

Ohai Chefs, 

Today we have released updated versions of Chef Server, Enterprise Chef Server, and Analytics in response to the recently announced OpenSSL vulnerabilities and  the POODLE SSLv3 attack disclosure. 

The full release announcement is here: https://www.getchef.com/blog/2014/10/17/security-release-chef-server-and-analytics-poodle-and-openssl-vulnerabilites/

We recommend that you upgrade your packages as soon as possible, or apply the appropriate mitigation steps from the blog post below:

https://www.getchef.com/blog/2014/10/14/security-response-ssl-poodle-attack-and-mitigation/

Note that these steps will protect only against the SSLv3 vulnerability - in order to be protected against the OpenSSL vulnerabilities, upgrade to the latest supported packages for your installation is required. 

Please reach out to  " target="_blank">  if you have any further questions or concerns.

-- 
Marc Paradise
Software Engineer - Chef Server

Chef Software, Inc.