Chef Habitat Builder CVE-2024-9825 Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: Chef Habitat (Builder) Product Alert - URL Name: Chef-Habitat-Builder-Product-Alert - Article Number: 000268431 - Environment: Chef Habitat builder-api package on-prem builder with version habitat/builder-api/10293/20240813081305 and earlier 2. Issue Description: - A medium-severity vulnerability has been identified, allowing the deletion of personal access tokens within the Chef Habitat Builder application. This vulnerability exists in the on-prem Habitat Builder product and has been fixed in recent versions. The vulnerability is assigned CVE-2024-9825, with a CVSS score of 3.1 and a rating of 5.4 (Medium). 3. Vulnerability Impact: - The vulnerability affects the Chef Habitat builder-api package on-prem builder, specifically versions habitat/builder-api/10293/20240813081305 and earlier. - It enables the deletion of personal access tokens within the on-prem Habitat Builder product. 4. Remediation: - For on-premises customers, the fix will be released on October 28th with Habitat version habitat/builder-api/10315/20240913162802, available to all customers on the stable channel. - For customers using the public SaaS-hosted Habitat builder, the vulnerability has already been patched, and no action is required. 5. Recommendation: - All customers are advised to upgrade to the latest stable version of Habitat Builder on-premises. This information helps users understand the severity, scope of impact, and remediation steps for the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Chef Habitat Builder CVE-2024-9825 Vulnerability Advisory