Chef Automate vulnerabilities

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

In Progress Chef Automate (versions earlier than 4.13.295) on Linux x86, an authenticated attacker can gain access to restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.