{"action":"closed","issue":{"url":"https://api.github.com/repos/chef/chef/issues/3251","labels_url":"https://api.github.com/repos/chef/chef/issues/3251/labels{/name}","comments_url":"https://api.github.com/repos/chef/chef/issues/3251/comments","events_url":"https://api.github.com/repos/chef/chef/issues/3251/events","html_url":"https://github.com/chef/chef/issues/3251","id":69821650,"number":3251,"title":"Chef-Server and Chef-Client upgrade have fired a clamav virus hit on nokogiri-1.6.3.1.gem","user":{"login":"idistech","id":10415284,"avatar_url":"https://avatars.githubusercontent.com/u/10415284?v=3","gravatar_id":"","url":"https://api.github.com/users/idistech","html_url":"https://github.com/idistech","followers_url":"https://api.github.com/users/idistech/followers","following_url":"https://api.github.com/users/idistech/following{/other_user}","gists_url":"https://api.github.com/users/idistech/gists{/gist_id}","starred_url":"https://api.github.com/users/idistech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/idistech/subscriptions","organizations_url":"https://api.github.com/users/idistech/orgs","repos_url":"https://api.github.com/users/idistech/repos","events_url":"https://api.github.com/users/idistech/events{/privacy}","received_events_url":"https://api.github.com/users/idistech/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-21T11:38:07Z","updated_at":"2015-07-29T17:24:08Z","closed_at":"2015-07-29T17:24:08Z","body":"Hi All, \r\nEnvironment: Ubuntu 14.04x64\r\nPerformed a Chef-server upgrade yesterday  ( 12.0.7 ) ad chef-client ( 12.0.3 ) on two different hosts, \r\nBoth have triggered clamav virus alerts.. \r\n\r\n<pre>/opt/opscode-manage/embedded/lib/ruby/gems/2.1.0/cache/nokogiri-1.6.3.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode-manage/embedded/lib/ruby/gems/2.1.0/gems/nokogiri-1.6.3.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode-push-jobs-server/embedded/lib/ruby/gems/1.9.1/cache/nokogiri-1.6.2.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode-push-jobs-server/embedded/lib/ruby/gems/1.9.1/gems/nokogiri-1.6.2.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode/embedded/lib/ruby/gems/2.1.0/cache/nokogiri-1.6.3.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode/embedded/lib/ruby/gems/2.1.0/gems/nokogiri-1.6.3.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode/embedded/service/gem/ruby/2.1.0/cache/nokogiri-1.6.2.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode/embedded/service/gem/ruby/2.1.0/gems/nokogiri-1.6.2.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/chef-sync/embedded/lib/ruby/gems/1.9.1/cache/nokogiri-1.6.2.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/chef-sync/embedded/lib/ruby/gems/1.9.1/gems/nokogiri-1.6.2.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode-reporting/embedded/lib/ruby/gems/1.9.1/cache/nokogiri-1.6.3.1.gem: Xml.Exploit.CVE_2013_3860-1 FOUND\r\n/opt/opscode-reporting/embedded/lib/ruby/gems/1.9.1/gems/nokogiri-1.6.3.1/test/xml/test_document.rb: Xml.Exploit.CVE_2013_3860-1 FOUND</pre>\r\n\r\nI assume Im not the only one with this ?, and is this a false positive or something real ? any knowledge ?\r\nI can see nokogiri-1.6.3.1 has been upgraded and version 1.6.6 is now available.. Any experiences greatly appreciated.\r\n\r\nGary"}}