From 1b3d64ce2f7719bd2527b3cb069bbd790d056f89 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Mon, 15 Sep 2025 13:30:28 +0200
Subject: [PATCH] RHEL-112424 CVE-2025-58060 cups: Authentication Bypass in
 CUPS Authorization Handling

Resolves: RHEL-112424
---
 CVE-2025-58060.patch | 35 +++++++++++++++++++++++++++++++++++
 cups.spec            |  9 ++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2025-58060.patch

diff --git a/CVE-2025-58060.patch b/CVE-2025-58060.patch
new file mode 100644
index 0000000..3720847
--- /dev/null
+++ b/CVE-2025-58060.patch
@@ -0,0 +1,35 @@
+diff --git a/scheduler/auth.c b/scheduler/auth.c
+index e7d0006..d70e21e 100644
+--- a/scheduler/auth.c
++++ b/scheduler/auth.c
+@@ -564,8 +564,12 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     switch (type)
+     {
+       default :
++	  {
++	    cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
++	    return;
++	  }
+       case CUPSD_AUTH_BASIC :
+-          {
++	  {
+ #if HAVE_LIBPAM
+ 	   /*
+ 	    * Only use PAM to do authentication.  This supports MD5
+@@ -737,6 +741,16 @@ cupsdAuthorize(cupsd_client_t *con)	/* I - Client connection */
+     gss_name_t		client_name;	/* Client name */
+ 
+ 
++   /*
++    * Only allow Kerberos if enabled...
++    */
++
++    if (type != CUPSD_AUTH_NEGOTIATE)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
++      return;
++    }
++
+ #  ifdef __APPLE__
+    /*
+     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
diff --git a/cups.spec b/cups.spec
index fbf6b9c..a7809f4 100644
--- a/cups.spec
+++ b/cups.spec
@@ -22,7 +22,7 @@ Summary: CUPS printing system
 Name: cups
 Epoch: 1
 Version: 2.2.6
-Release: 62%{?dist}
+Release: 63%{?dist}
 License: GPLv2+ and LGPLv2 with exceptions and AML
 Url: http://www.cups.org/
 Source0: https://github.com/apple/cups/releases/download/v%{VERSION}/cups-%{VERSION}-source.tar.gz
@@ -191,6 +191,8 @@ Patch93: 0001-mirror-ipp-everywhere-printer-changes-from-master.patch
 Patch94: 0001-refactor-make-and-model-code.patch
 Patch95: 0001-ppdize-preset-and-template-names.patch
 Patch96: 0001-Fix-make-and-model-whitespace-trimming-Issue-1096.patch
+# RHEL-112424 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+Patch97: CVE-2025-58060.patch
 
 Patch1000: cups-lspp.patch
 
@@ -519,6 +521,8 @@ Sends IPP requests to the specified URI and tests and/or displays the results.
 %patch94 -p1 -b .make-model-refact
 %patch95 -p1 -b .ppdize-presets
 %patch96 -p1 -b .make-model-trim
+# RHEL-112424 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+%patch97 -p1 -b .cve-2025-58060
 
 
 sed -i -e '1iMaxLogSize 0' conf/cupsd.conf.in
@@ -946,6 +950,9 @@ rm -f %{cups_serverbin}/backend/smb
 %{_mandir}/man5/ipptoolfile.5.gz
 
 %changelog
+* Thu Sep 04 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-63
+- RHEL-112424 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
+
 * Fri Oct 25 2024 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-62
 - RHEL-60338 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file