Address CVE-2014-3628

[pburkholder]

Close an audit finding: http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%[email protected]%3E

[stevendanna]

@pburkholder Thanks for this. A couple of todo's based on the process in CONTRIBUTING.md:

1. Include a ChangeLog-Entry in your commit message
2. Run this build through wilson.ci.opscode.us using chef-server-12-ad_hoc with your branch name. (Ping in chat if you need help).

Also, do you know if we are actively affected by that CVE or is this a "we are out of date and there are CVEs against the version we are on"-type update. Either way we should update but it does affect what we say about it in the release notes.

[irvingpop]

Wilson build link: http://wilson.ci.chef.co/job/chef-server-12-build/1513/

[irvingpop]

That build failed because the s3 cache entry was missing for Solr 4.10.4 ( bin/omnibus cache populate fix that).

@pburkholder I rebased this branch (heads up, I force pushed) and am sending a new build through wilson right now: http://wilson.ci.chef.co/job/chef-server-12-build/1516/

[irvingpop]

Validated this build under load (via ec-metal) - upgrade from an earlier build works, everything looks good.

paging @chef/lob for review

[stevendanna]

I'm 👍 thanks for the testing @irvingpop

[sdelano]

👍 - let's get the changelog updated too