Lack of data validation In cups-filters
Description
CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 1.28.17-5 | ||
debian 11 | 1.28.7-1+deb11u3 | ||
debian 12 | 1.28.17-3+deb12u1 | ||
debian 14 | 1.28.17-5 | ||
 rpm rhel9.2 | 0:1.28.7-11.el9_2.2 | ||
rpm rhel7 | - | - | |
rpm rhel8 | 0:1.20.0-35.el8_10 | ||
rpm rhel8.8 | 0:1.20.0-29.el8_8.3 | ||
rpm rhel9 | 0:1.28.7-17.el9_4 |
Aliases
References