Description (CNA)
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Progress Software Corporation / Chef InSpec | affected 4.0.0 before 4.56.58; affected 5.0.0 before 5.22.29 |
CWE
CWE-94, CWE-917
References
- https://docs.chef.io/release_notes_inspec/
- https://docs.chef.io/inspec/cli/
- https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Inspec-CVE-2023-42658
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.