From 48de46d952e74ab41f91e9d3135066fbb31855ce Mon Sep 17 00:00:00 2001 From: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> Date: Tue, 1 Sep 2026 17:06:03 -0500 Subject: [PATCH 1/2] Add faraday >= 2.14.3 floor to chef-server-ctl and oc-id Gemfiles Dependabot flagged faraday in both src/chef-server-ctl/Gemfile.lock and src/oc-id/Gemfile.lock, resolved to 2.14.1, affected by two CVEs: - GHSA-98m9-hrrm-r99r / CVE-2026-54297 (high, CVSS 7.5): uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters. Fixed in 2.14.3. Dependabot alerts 385 (chef-server-ctl), 384 (oc-id). - GHSA-5rv5-xj5j-3484 / CVE-2026-33637 (low): incomplete fix for GHSA-33mh-2634-fwr2 -- protocol-relative URI objects still bypass host scoping. Fixed in 2.14.2 (2.14.3 supersedes it). Dependabot alerts 345 (chef-server-ctl), 344 (oc-id). Added an explicit >= 2.14.3 floor to both Gemfiles and regenerated both lockfiles (Docker, ruby:3.1.3 + bundler 2.3.27, matching the pinned BUNDLED WITH version -- unchanged by this change). Resolved: faraday 2.14.1 -> 2.14.3; faraday-net_http 3.4.2 -> 3.4.4 (transitive, expected resolver side effect). Declared as a bare floor, not routed through omnibus-config's safe_versions.rb/resolve_safe_version.call (same reasoning as the existing concurrent-ruby floor immediately above it in both files): that mechanism exists to keep a ruby_gems_cleanup.rb threshold and a Gemfile floor from drifting apart for the same gem -- it is not a generic place to declare any gem's minimum version. No ticket or on-disk test/scan finding establishes a stale-gem-left-on-disk cleanup need for faraday, so there is no second consumer for safe_versions.rb to keep in sync with this floor. CHEF-37252 Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> --- src/chef-server-ctl/Gemfile | 15 +++++++++++++++ src/chef-server-ctl/Gemfile.lock | 5 +++-- src/oc-id/Gemfile | 7 +++++++ src/oc-id/Gemfile.lock | 5 +++-- 4 files changed, 28 insertions(+), 4 deletions(-) diff --git a/src/chef-server-ctl/Gemfile b/src/chef-server-ctl/Gemfile index 61c3dbd5d0..68c97ec84e 100644 --- a/src/chef-server-ctl/Gemfile +++ b/src/chef-server-ctl/Gemfile @@ -123,3 +123,18 @@ gem "rexml", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}" # of this bare floor only if a future ticket or test finding creates that # second (cleanup) consumer. gem "concurrent-ruby", ">= 1.3.8" + +# faraday (CHEF-37252 / GHSA-98m9-hrrm-r99r [high], GHSA-5rv5-xj5j-3484 [low] -- +# Dependabot alerts 385, 345). Declared as a plain, direct floor here -- NOT +# routed through the SafeVersions/resolve_safe_version mechanism above, unlike +# rack/rexml. That indirection exists specifically so ruby_gems_cleanup.rb (in +# chef-server-omnibus-config) and a Gemfile floor for the *same* gem can't drift +# apart -- it's a single source of truth for two consumers, not a generic place +# to declare any gem's minimum version. There is no ruby_gems_cleanup.rb entry +# for faraday (no ticket or on-disk test finding has established a +# stale/vulnerable-version-left-on-disk cleanup need for it, unlike +# rack/rexml/net-imap), so there is only one consumer here -- nothing for +# SafeVersions to keep in sync. Add a SafeVersions constant instead of this bare +# floor only if a future ticket or test finding creates that second (cleanup) +# consumer. +gem "faraday", ">= 2.14.3" diff --git a/src/chef-server-ctl/Gemfile.lock b/src/chef-server-ctl/Gemfile.lock index 055444fc8b..2c1d64403e 100644 --- a/src/chef-server-ctl/Gemfile.lock +++ b/src/chef-server-ctl/Gemfile.lock @@ -202,7 +202,7 @@ GEM ed25519 (1.4.0) erubi (1.13.1) erubis (2.7.0) - faraday (2.14.1) + faraday (2.14.3) faraday-net_http (>= 2.0, < 3.5) json logger @@ -210,7 +210,7 @@ GEM faraday (>= 1, < 3) faraday-http-cache (2.5.1) faraday (>= 0.8) - faraday-net_http (3.4.2) + faraday-net_http (3.4.4) net-http (~> 0.5) ffi (1.16.3) ffi-libarchive (1.1.14) @@ -512,6 +512,7 @@ DEPENDENCIES chef-server-ctl! chefstyle concurrent-ruby (>= 1.3.8) + faraday (>= 2.14.3) knife (~> 19.0.105) knife-ec-backup (~> 3.0.8) public_suffix (< 7.0) diff --git a/src/oc-id/Gemfile b/src/oc-id/Gemfile index 0a894240fb..392866da8f 100644 --- a/src/oc-id/Gemfile +++ b/src/oc-id/Gemfile @@ -136,6 +136,13 @@ gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}" # resolve_safe_version.call(...)/safe_versions.rb. gem 'concurrent-ruby', ">= 1.3.8" +# faraday (CHEF-37252 / GHSA-98m9-hrrm-r99r [high], GHSA-5rv5-xj5j-3484 [low] -- +# Dependabot alerts 384, 344). Bare floor, same reasoning as +# src/chef-server-ctl/Gemfile's identical line: no ruby_gems_cleanup.rb consumer +# exists for this gem, so it does not go through +# resolve_safe_version.call(...)/safe_versions.rb. +gem 'faraday', ">= 2.14.3" + gem 'omniauth-chef', '~> 0.4.1', git: "https://github.com/talktovikas/omniauth-chef.git", branch: "vikas/chef-upgrade" diff --git a/src/oc-id/Gemfile.lock b/src/oc-id/Gemfile.lock index 8669b87319..cd63275398 100644 --- a/src/oc-id/Gemfile.lock +++ b/src/oc-id/Gemfile.lock @@ -316,13 +316,13 @@ GEM factory_bot_rails (6.5.1) factory_bot (~> 6.5) railties (>= 6.1.0) - faraday (2.14.1) + faraday (2.14.3) faraday-net_http (>= 2.0, < 3.5) json logger faraday-follow_redirects (0.5.0) faraday (>= 1, < 3) - faraday-net_http (3.4.2) + faraday-net_http (3.4.4) net-http (~> 0.5) ffi (1.16.3) ffi-libarchive (1.1.14) @@ -769,6 +769,7 @@ DEPENDENCIES config (~> 4.1) doorkeeper (~> 5.0) factory_bot_rails (~> 6.4) + faraday (>= 2.14.3) jbuilder (~> 2.11) jquery-rails jwt (>= 3.2.0) From a22c78c4efc7085858ee36eac6327424b8526e64 Mon Sep 17 00:00:00 2001 From: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> Date: Thu, 3 Sep 2026 19:57:34 -0500 Subject: [PATCH 2/2] REVERT ME: Point omnibus submodule at unmerged faraday floor fix for testing Temporarily bumps the omnibus/ submodule pointer to c489623, the faraday >= 2.14.3 floor fix on chef-server-omnibus-config's CHEF-37962/lbaker branch (chef/chef-server-omnibus-config#33, not yet merged), so an adhoc build from this branch can validate the fix end-to-end before that PR merges. This commit MUST be reverted before this branch/PR (#4239) merges to main -- the submodule pointer should reference a merged main commit in chef-server-omnibus-config, not an unmerged feature-branch commit. A follow-up commit will re-bump the pointer to the real post-merge main SHA. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> --- omnibus | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/omnibus b/omnibus index 975b328a43..c4896231de 160000 --- a/omnibus +++ b/omnibus @@ -1 +1 @@ -Subproject commit 975b328a43cdb9ced69125d873e93ea6d5bbd792 +Subproject commit c4896231de5ac1de0e3d5d715cd0fc1d9f44d97d