Ohai Chefs!
Today we have releases of Chef Server 12.1.0, Enterprise Chef Server 11.3.2, and Chef Manage 1.17.0 which contain the following security updates:
- Redis 2.8.21
This update addresses CVE-2015-4335, a remote code execution vulnerability in Redis. We recommend that users of Chef Manage and of Chef Server in HA or Tiered topologies update as soon as possible. Open Source Chef Server 11 is not affected. Supermarket will ship with an updated Redis in the next release. Chef Servers in a standalone configuration are configured such that Redis only listens for local connections; however, we still encourage everyone to upgrade.
Updated packages are available for immediate download on http://downloads.chef.io and via our Apt and RPM repositories.
In addition to this security update, Chef Server 12.1.0 has performance improvements, new features, and bug fixes. Please see the Chef Server 12.1 Release Announcement.
