Greetings Chefs!
We are happy to announce the release of Chef Server 11.0.8 containing
a number of security and bug fixes as detailed below.
The MVP for this release is **Joe Breu**
( (https://twitter.com/rackerjoe)) who contributed a fix
for [CHEF-3889](http://tickets.opscode.com/browse/CHEF-3889) to
correct PostgreSQL tuning to allow Chef Server to be installed on
systems with more than 64GB of RAM.
## Updated Components:
### chef-server-webui 11.0.4
This release contains an updated Rails version of 3.2.13 which contains
security fixes for the following vulnerabilities:
* [CVE-2013-1854] Symbol DoS vulnerability in Active Record
* [CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack
* [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users
* [CVE-2013-1857] XSS Vulnerability in the sanitize helper of Rails
This fixes the following issues:
* [CHEF-4059](http://tickets.opscode.com/browse/CHEF-4059) update Rails version
to 3.2.13 for security issues
### PostgreSQL 9.2.4
This version fixes the following vulnerabilities:
* [CVE-2013-1899] - makes it possible for a connection request
containing a database name that begins with "-" to be crafted that can
damage or destroy files within a server's data directory. Anyone with
access to the port the PostgreSQL server listens on can initiate this
request.
* [CVE-2013-1900] - wherein random numbers generated by contrib/pgcrypto
functions may be easy for another database user to guess
* [CVE-2013-1901] - which mistakenly allows an unprivileged user to run
commands that could interfere with in-progress backups.
These issues are also addressed but only affect the graphical installers
for Linux and Mac OS X (note used by chef-server):
* [CVE-2013-1902] - the use of predictable filenames in /tmp
* [CVE-2013-1903] - insecure passing of superuser passwords to a script
More details in the PostgreSQL release announcement:
http://www.postgresql.org/about/news/1456/
This fixes the following issues:
* [CHEF-4060](http://tickets.opscode.com/browse/CHEF-4060) Upgrade PostgreSQL
9.2.4
## Bug Fixes:
### don't override user provided nginx url
If the user did not provide a value for the nginx `url` we will
construct one, taking the value passed into `ssl_port` into account.
This fixes the following issues:
* [CHEF-4029](http://tickets.opscode.com/browse/CHEF-4029) configurable bookshelf
url & nginx ssl port issue
### ensure the `enable_non_ssl` nginx attribute works
Currently trying to enable non-ssl mode has no effect. This commit
ensures we render a both an HTTP and HTTPS version of the Chef API lb
config. This behavior now also matches Private Chef.
This fixes the following issues:
* [CHEF-4029](http://tickets.opscode.com/browse/CHEF-4029) configurable bookshelf
url & nginx ssl port issue
### Ensure Nginx config respects configured ports.
This patch makes Nginx's rewrite and proxy_set_header directives respect
the configured SSL port (`node['chef_server']['nginx']['ssl_port']`).
This fixes the following issues:
* [CHEF-3849](http://tickets.opscode.com/browse/CHEF-3849) redirect for login
for webui ignores `ssl_port`
### Add configurable bookshelf url attribute.
This new attribute will default to the value of the Nginx url which is
built from the configured `api_fqdn` and Nginx ssl port.
Values set in the `/etc/chef-server/chef-server.rb` file always take
precedence so it is still possible to change the bookshelf vip to
something like "https://s3.amazonaws.com" if S3 is being used as the
backend cookbook store.
This fixes the following issues:
* [CHEF-3853](http://tickets.opscode.com/browse/CHEF-3853) checksum URLs
generated by POST /sandboxes do not respect configured load balancer port
### Build Erchef url off configured values for listen + port.
The default attribute value for `node['chef_server']['erchef']['url']`
is out of date the instant a user configures alternate values for
`listen` or `port`. We'll remove this misleading attribute and just
compute a url when we need it using the following format:
http://ERCHEF_LISTEN:ERCHEF_PORT
This fixes the following issue:
* [CHEF-3887](http://tickets.opscode.com/browse/CHEF-3887) Cannot change port
of erchef
### Build webui url off configured values for listen + port
The default attribute value for
`node['chef_server']['chef-server-webui']['url']` is out of date the
instant a user configures alternate values for `listen` or `port`. We'll
remove this misleading attribute and just compute a url when we need it
using the following format:
http://WEBUI_LISTEN:WEBUI_PORT
`node['chef_server']['chef-server-webui']['listen']` has also been
updated to match the idioms of other components `listen` attribute.
### Build solr url off configured values for ip_address + port.
The default attribute value for `node['chef_server']['chef-solr']['url']`
is out of date the instant a user configures alternate values for
`ip_address ` or `port`. We'll remove this misleading attribute and just
compute a url when we need it using the following format:
http://SOLR_IP:SOLR_PORT
### stop `runit_service` supervise/ok race condition
Currently we wait 10 seconds for a runit service's supervise/ok named
pipe. On slower systems (*cough* CentOS 5.x) this 10 second wait is not
long enough. This commit updates the embedded runit cookbook that ships
in omnibus-chef to match the indefinite block used in the current
version of community cookbook:
https://github.com/opscode-cookbooks/runit/blob/1.1.0/libraries/provider_runit_service.rb#L151-L153
## Improvements:
### Maximum on PostgreSQL shared_pages on machines where installed RAM/4 exceeds the size of shmmax of 14GB
On machines with installed RAM > 64GB the postgresql `shared_buffers` configuration
would exceed shmmax. This change places a maximum on `shared_pages` on machines where
Installed RAM / 4 exceeds the size of shmmax of 14GB
This does not solve the case where you have a 32bit installation and more than 16GB
of RAM.
This resolves the following issue:
* [CHEF-3889](http://tickets.opscode.com/browse/CHEF-3889) tunables for
postgresql in chef server 11 do not work when system has more than 64GB of
RAM
Thanks for the contribution Joe Breu (@rackerjoe)!
### Packaging code (Omnibus) improvements
* The Omnibus-related packaging code has been moved to it's own repository at:
https://github.com/opscode/omnibus-chef-server
* Chef Server Omnibus project has been updated to support the newly released
Omnibus 1.0.
* `opscode-runsvdir -> chef-server-runsvdir` - For consistency (and
sanity), the upstart system job configuration should match the
Omnibus project name.
Archive powered by MHonArc 2.6.16.