Description
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | Chef InSpec | 4.0.0 – < 4.56.58 , 5.0.0 – < 5.22.29 | 4.56.58 |
References
- https://docs.chef.io/release_notes_inspec/ release-notes
- https://docs.chef.io/inspec/cli/ release-notes
- https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Inspec-CVE-2023-42658 vendor-advisory