[chef] Re: Rack vulnerabilities in chef-server-webui in Chef Server 11

[Jesse Campbell < >]

Is the intention that starting with chef 12 server, the webui will be a value add of the hosted/private offerings?

On Sat, Feb 9, 2013 at 11:40 AM, Bryan McLellan < " target="_blank"> > wrote:

We believe that the chef-server-webui in Chef Server 11 is vulnerable to recently announced security vulnerabilities in Rack [1]. The Chef 10 webui does not run on rails. We recommend that Chef 11 Server users shut down the webui to prevent any expoitation.

To do so, create '/etc/chef-server/chef-server.rb' and add this line to it:

webui_enable false

Then run 'sudo chef-server-ctl reconfigure'

On Monday we will release a new Chef Server 11 package that upgrades Rack to 1.4.5 to resolve this issue. The webui will be configured to not start by default in Monday's release and subsequent releases and we are deprecating it. The chef-server-webui will not be included in the Chef 12 Server open-source release.

---
Bryan McLellan | opscode | technical program manager, open source
(c) 206.607.7108 | (t) @btmspox | (b) http://blog.loftninjas.org

[1] http://rack.github.com/