The RHEL-8 version of chef is marked with "el7" in the version. I know it is compatible but qualys scans marked the package is being out of date. There is no complaint from the same RPM installed on CentOS-7. While we have marked it as an exception, I'd rather not. I'm afraid that we'll forget about it and it hide a problem when it actually is out-of-date.
Since qualys is a black box appliance, I have no insight into the actual implementation of the check.
The scan the reported the issue was performed by a third party and all I saw was a list of "out of date packages". Our in-house qualys scanner does not report the issue but we are generation behind.