import CS cups-filters-1.28.7-13.el9

2023-09-21 18:15:44 +00:00 · 2023-09-21 18:15:44 +00:00 · 779930eecf
commit 779930eecf
parent d69ef3f172
4 changed files with 295 additions and 1 deletions
--- a/SOURCES/beh-cve2023.patch
+++ b/SOURCES/beh-cve2023.patch
@ -0,0 +1,107 @@
+diff --git a/backend/beh.c b/backend/beh.c
+index 225fd27..5e9cee0 100644
+--- a/backend/beh.c
+++ b/backend/beh.c
+@@ -22,6 +22,7 @@
+ #include "backend-private.h"
+ #include <cups/array.h>
+ #include <ctype.h>
+#include <sys/wait.h>
+ 
+ /*
+  * Local globals...
+@@ -213,10 +214,14 @@ call_backend(char *uri,                 /* I - URI of final destination */
+ 	     char **argv,		/* I - Command-line arguments */
+ 	     char *filename) {          /* I - File name of input data */
+   const char	*cups_serverbin;	/* Location of programs */
+  char          *backend_argv[8];       // Arguments for called CUPS backend
+   char		scheme[1024],           /* Scheme from URI */
+                 *ptr,			/* Pointer into scheme */
+-		cmdline[65536];		/* Backend command line */
+-  int           retval;
+		backend_path[2048];	// Backend path
+  int           pid,
+                wait_pid,
+                wait_status,
+                retval = 0;
+ 
+  /*
+   * Build the backend command line...
+@@ -235,16 +240,19 @@ call_backend(char *uri,                 /* I - URI of final destination */
+     fprintf(stderr,
+ 	    "ERROR: beh: Direct output into a file not supported.\n");
+     exit (CUPS_BACKEND_FAILED);
+-  } else
+-    snprintf(cmdline, sizeof(cmdline),
+-	     "%s/backend/%s '%s' '%s' '%s' '%s' '%s' %s",
+-	     cups_serverbin, scheme, argv[1], argv[2], argv[3],
+-	     /* Apply number of copies only if beh was called with a
+-		file name and not with the print data in stdin, as
+-	        backends should handle copies only if they are called
+-	        with a file name */
+-	     (argc == 6 ? "1" : argv[4]),
+-	     argv[5], filename);
+  }
+
+  backend_argv[0] = uri;
+  backend_argv[1] = argv[1];
+  backend_argv[2] = argv[2];
+  backend_argv[3] = argv[3];
+  backend_argv[4] = (argc == 6 ? "1" : argv[4]);
+  backend_argv[5] = argv[5];
+  backend_argv[6] = filename;
+  backend_argv[7] = NULL;
+
+  snprintf(backend_path, sizeof(backend_path),
+	   "%s/backend/%s", cups_serverbin, scheme);
+ 
+  /*
+   * Overwrite the device URI and run the actual backend...
+@@ -253,17 +261,41 @@ call_backend(char *uri,                 /* I - URI of final destination */
+   setenv("DEVICE_URI", uri, 1);
+ 
+   fprintf(stderr,
+-	  "DEBUG: beh: Executing backend command line \"%s\"...\n",
+-	  cmdline);
+	  "DEBUG: beh: Executing backend command line \"%s '%s' '%s' '%s' '%s' '%s'%s%s\"...\n",
+	  backend_path, backend_argv[1], backend_argv[2], backend_argv[3],
+	  backend_argv[4], backend_argv[5],
+	  (backend_argv[6] && backend_argv[6][0] ? " " : ""),
+	  (backend_argv[6] && backend_argv[6][0] ? backend_argv[6] : ""));
+   fprintf(stderr,
+ 	  "DEBUG: beh: Using device URI: %s\n",
+ 	  uri);
+ 
+-  retval = system(cmdline) >> 8;
+  if ((pid = fork()) == 0)
+  {
+    retval = execv(backend_path, backend_argv);
+
+    if (retval == -1)
+      fprintf(stderr, "ERROR: Unable to execute backend: %s\n",
+	      strerror(errno));
+    exit (CUPS_BACKEND_FAILED);
+  }
+  else if (pid < 0)
+  {
+    fprintf(stderr, "ERROR: Unable to fork for backend\n");
+    return (CUPS_BACKEND_FAILED);
+  }
+
+  while ((wait_pid = wait(&wait_status)) < 0 && errno == EINTR);
+ 
+-  if (retval == -1)
+-    fprintf(stderr, "ERROR: Unable to execute backend command line: %s\n",
+-	    strerror(errno));
+  if (wait_pid >= 0 && wait_status)
+  {
+    if (WIFEXITED(wait_status))
+      retval = WEXITSTATUS(wait_status);
+    else if (WTERMSIG(wait_status) != SIGTERM)
+      retval = WTERMSIG(wait_status);
+    else
+      retval = 0;
+  }
+ 
+   return (retval);
+ }
--- a/SOURCES/lftocrlf
+++ b/SOURCES/lftocrlf
@ -0,0 +1,124 @@
+#!/bin/bash
+## Copyright (C) 2003-2006 Red Hat, Inc.
+## Copyright (C) 2003-2006 Tim Waugh <twaugh@redhat.com>
+## Changed on 2007/05/17, Opher Shachar, LADPC Ltd.
+##     Added support for page-ranges option.
+##     Added page accounting.
+
+## This program is free software; you can redistribute it and/or
+## modify it under the terms of the GNU General Public License
+## as published by the Free Software Foundation; either version 2
+## of the License, or (at your option) any later version.
+
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+if [ $# == 0 ]; then
+  echo >&2 "ERROR: $0 job-id user title copies options [file]"
+  exit 1
+fi
+
+# Extract the papersize
+SENDFF=`grep '^\*DefaultSendFF' "$PPD" | cut -d\  -f2`
+COPIES=1
+if [ $# -ge 4 ]; then
+  COPIES="$4"
+fi
+
+if [ $# -lt 6 ]; then
+  unset TMPFILE
+  trap -- 'rm -f "$TMPFILE"' EXIT
+  TMPFILE=$(mktemp ${TMPDIR:-/tmp}/lftocrlf.XXXXXX)
+  cat > "$TMPFILE"
+else
+  TMPFILE="$6"
+fi
+
+PR=${5#*page-ranges=}
+# Do options specify page-ranges?
+if [[ "$PR" != "$5" ]]; then
+  PR=${PR%% *}
+else
+  #unset PR
+  PR=1-999999
+fi
+
+if [[ "$PR" ]]; then
+  TMPFILE2=$(mktemp ${TMPDIR:-/tmp}/lftocrlf2.XXXXXX)
+  pagenum=0
+  EOF=
+  { 
+  while [[ "$PR" ]]; do
+    pl=${PR%%,*}		;# take first subrange
+    PR=${PR#$pl};PR=${PR#,}	;# remove from range list
+    pu=${pl#*-}			;# extract upper and lower
+    pl=${pl%-*}			;# pages of subrange
+    # Allows interpreting 0-5,3-10 as 1-5,6-10 rejects 5-1 or 1-
+    (( pagenum >= pl )) && pl=$(( pagenum + 1 ))
+    (( pl > pu )) && continue
+    
+    # Loop reading pages until at or over lower page of subrange.
+    while read -d `echo -ne '\f'` -r; do
+      (( pagenum++ ))
+      (( pagenum == pl )) && break
+    done
+    # Did we reach lower page of subrange or EOF?
+    if (( pagenum < pl )); then
+      [[ ! "$REPLY" ]] && break		;# empty last page - we're done.
+      (( pagenum++ ))
+      EOF=y
+    fi
+    # Output page and report to page log
+    if (( pagenum == pl )); then
+      echo -n "${REPLY}" >>"$TMPFILE2"
+      # If EOF then page has no final FF
+      [[ ! "$EOF" ]] && echo -ne '\f' >>"$TMPFILE2"
+      echo "PAGE: $pagenum $COPIES" >&2
+    fi
+    [[ "$EOF" ]] && break
+    # Is the current subrange a single page?
+    (( pagenum == pu )) && continue
+    while read -d `echo -ne '\f'` -r; do
+      (( pagenum++ ))
+      echo -ne "${REPLY}\f" >>"$TMPFILE2"
+      echo "PAGE: $pagenum $COPIES" >&2
+      (( pagenum == pu )) && break
+    done
+    # Could be that we reached EOF before page boundry
+    if (( pagenum < pu )); then
+      if [[ "$REPLY" ]]; then
+        (( pagenum++ ))
+        echo -n "${REPLY}" >>"$TMPFILE2"
+        echo "PAGE: $pagenum $COPIES" >&2
+      fi
+      break
+    fi
+  done
+  } <"$TMPFILE"
+else
+  TMPFILE2="$TMPFILE"
+  pc=$(grep -co `echo -ne '\f'` "$TMPFILE2")
+  pc=$(( pc * $COPIES ))
+  echo "PAGE: $pc" >&2
+fi
+
+while [ "$COPIES" -gt 0 ]; do
+  # Just translate LF->CRLF at the moment, until the PPD has options added.
+  sed -e 's/$/'`echo -ne '\r'`'/g' "$TMPFILE2"
+
+  if [ "$SENDFF" == "True" ]
+    then
+    echo -ne \\014
+  fi
+
+  COPIES=$(($COPIES - 1))
+done
+# Cleanup
+[[ "$TMPFILE" != "$TMPFILE2" ]] && rm -f "$TMPFILE2"
+exit 0
--- a/SOURCES/lftocrlf.ppd
+++ b/SOURCES/lftocrlf.ppd
@ -0,0 +1,47 @@
+*PPD-Adobe: "4.3"
+*%
+*% Text-only printer definition
+*%
+*FormatVersion:	"4.3"
+*FileVersion:	"1.1"
+*LanguageVersion: English
+*LanguageEncoding: ISOLatin1
+*PCFileName:	"LFTOCRLF.PPD"
+*Manufacturer:	"Generic"
+*Product:	"(Generic)"
+*cupsVersion:   1.0
+*cupsManualCopies: True
+*cupsModelNumber:  2
+*cupsFilter:    "text/plain 0 lftocrlf"
+*ModelName:     "Generic LF-to-CRLF printer"
+*ShortNickName: "Generic LF-to-CRLF printer"
+*NickName:      "Generic LF-to-CRLF printer"
+*PSVersion:	"(2017.000) 0"
+*LanguageLevel:	"2"
+*ColorDevice:	False
+*DefaultColorSpace: Gray
+*FileSystem:	False
+*Throughput:	"8"
+*LandscapeOrientation: Plus90
+*VariablePaperSize: False
+*TTRasterizer:	Type42
+*DefaultImageableArea: Letter
+*ImageableArea Letter/US Letter:	"18 36 594 756"
+*DefaultPaperDimension: Letter
+*PaperDimension Letter/Letter:		"612 792"
+*OpenUI *PageSize/Media Size: PickOne
+*OrderDependency: 10 AnySetup *PageSize
+*DefaultPageSize: Letter
+*PageSize Letter/Letter:	"<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
+*CloseUI: *PageSize
+*OpenUI *PageRegion: PickOne
+*OrderDependency: 10 AnySetup *PageRegion
+*DefaultPageRegion: Letter
+*PageRegion Letter/Letter:	"<</PageSize[612 792]/ImagingBBox null>>setpagedevice"
+*CloseUI: *PageRegion
+
+*OpenUI *SendFF: Boolean
+*DefaultSendFF: False
+*SendFF True/True:        ""
+*SendFF False/False:   ""
+*CloseUI: *SendFF
--- a/SPECS/cups-filters.spec
+++ b/SPECS/cups-filters.spec
@ -11,7 +11,7 @@
 Summary: OpenPrinting CUPS filters and backends
 Name:    cups-filters
 Version: 1.28.7
-Release: 11%{?dist}
+Release: 13%{?dist}

 # For a breakdown of the licensing, see COPYING file
 # GPLv2:   filters: commandto*, imagetoraster, pdftops, rasterto*,
@ -26,6 +26,8 @@ License: GPLv2 and GPLv2+ and GPLv3 and GPLv3+ and LGPLv2+ and MIT and BSD with

 Url:     http://www.linuxfoundation.org/collaborate/workgroups/openprinting/cups-filters
 Source0: http://www.openprinting.org/download/cups-filters/cups-filters-%{version}.tar.xz
+Source1: lftocrlf.ppd
+Source2: lftocrlf

 # backported from upstream
 #Patch01: 0001-libcupsfilters-In-the-PPD-generator-really-give-prio.patch
@ -36,6 +38,8 @@ Patch01: 0001-cups-browsed-Always-save-.-default-option-entries-fr.patch
 Patch02: 0001-cups-browsed.c-Make-NotifLeaseDuration-configurable-.patch
 # 1982118 - [RHEL 9] pdftopdf doesn't handle "page-range=10-2147483647" correctly
 Patch03: 0001-libcupsfilters-Fix-page-range-like-10-in-pdftopdf-fi.patch
+# CVE-2023-24805 cups-filters: remote code execution in cups-filters, beh CUPS backend
+Patch04: beh-cve2023.patch


 # autogen.sh
@ -226,6 +230,10 @@ The package provides filters and cups-brf backend needed for braille printing.
 %install
 %make_install

+# 2229784 - Add textonly driver back, but as lftocrlf
+install -p -m 0755 %{SOURCE2} %{buildroot}%{_cups_serverbin}/filter/lftocrlf
+install -p -m 0644 %{SOURCE1} %{buildroot}%{_datadir}/ppd/cupsfilters/lftocrlf.ppd
+
 # Don't ship libtool la files.
 rm -f %{buildroot}%{_libdir}/lib*.la

@ -305,6 +313,8 @@ done
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetopdf
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetops
 %attr(0755,root,root) %{_cups_serverbin}/filter/imagetoraster
+# 2229784 - Add textonly driver back, but as lftocrlf
+%attr(0755,root,root) %{_cups_serverbin}/filter/lftocrlf
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftopdf
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftops
 %attr(0755,root,root) %{_cups_serverbin}/filter/pdftoraster
@ -398,6 +408,12 @@ done
 %endif

 %changelog
+* Tue Aug 08 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-13
+- 2229784 - Add textonly driver back, but as lftocrlf
+
+* Wed Jun 07 2023 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-12
+- CVE-2023-24805 cups-filters: remote code execution in cups-filters, beh CUPS backend
+
 * Thu Sep 22 2022 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-11
 - 2129054 - build braille subpackage only on Fedora and CentOS Stream > 9