chef-workstation icon indicating copy to clipboard operation
chef-workstation copied to clipboard

CHEF-15132-Updated Libraries having CVEs for upcoming WS release

Open nikhil2611 opened this issue 4 months ago • 3 comments

Description

  • Updated the openSSL v3.0.15 as v3.0.12 have high/critical CVEs - https://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/version_id-1775730/Openssl-Openssl-3.0.12.html

  • Updated the libxml2 v2.12.7 as v2.12.5 have high CVE - https://www.cvedetails.com/vulnerability-list/vendor_id-1962/product_id-3311/version_id-1777449/Xmlsoft-Libxml2-2.12.5.html

  • Updated the libarchive v3.7.5 as v3.7.4 have high and critical CVEs - https://www.cvedetails.com/vulnerability-list/vendor_id-12872/product_id-26168/version_id-1807154/Libarchive-Libarchive-3.7.4.html

  • Adding the git-windows v2.47.0 as v2.41.0 is bundled with curl v8.1 which is having high/critical culnerability

  • The RDoc gem, as installed by base Ruby and not chef-workstation, has a CVE. Here we explicitly add/update the rdoc version to overcome that CVE. Notes here: https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/

Related Issue

https://progresssoftware.atlassian.net/browse/CHEF-15132

Types of changes

  • [ ] Bug fix (non-breaking change which fixes an issue)
  • [ ] New feature (non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to change)
  • [ ] Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

  • [ ] I have read the CONTRIBUTING document.
  • [ ] I have run the pre-merge tests locally and they pass.
  • [ ] I have updated the documentation accordingly.
  • [ ] I have added tests to cover my changes.
  • [ ] If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
  • [ ] All new and existing tests passed.
  • [ ] All commits have been signed-off for the Developer Certificate of Origin.

nikhil2611 avatar Oct 22 '24 13:10 nikhil2611