import UBI cups-2.4.10-11.el10_0.1
This commit is contained in:
parent
b0a5b1d736
commit
52a0b3b46e
46
CVE-2025-58060.patch
Normal file
46
CVE-2025-58060.patch
Normal file
@ -0,0 +1,46 @@
|
||||
diff --git a/scheduler/auth.c b/scheduler/auth.c
|
||||
index 5fa53644d..3c9aa72aa 100644
|
||||
--- a/scheduler/auth.c
|
||||
+++ b/scheduler/auth.c
|
||||
@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
|
||||
int userlen; /* Username:password length */
|
||||
|
||||
|
||||
+ /*
|
||||
+ * Only allow Basic if enabled...
|
||||
+ */
|
||||
+
|
||||
+ if (type != CUPSD_AUTH_BASIC)
|
||||
+ {
|
||||
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
authorization += 5;
|
||||
while (isspace(*authorization & 255))
|
||||
authorization ++;
|
||||
@@ -558,7 +568,6 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
|
||||
* Validate the username and password...
|
||||
*/
|
||||
|
||||
- if (type == CUPSD_AUTH_BASIC)
|
||||
{
|
||||
#if HAVE_LIBPAM
|
||||
/*
|
||||
@@ -727,6 +736,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
|
||||
/* Output token for username */
|
||||
gss_name_t client_name; /* Client name */
|
||||
|
||||
+ /*
|
||||
+ * Only allow Kerberos if enabled...
|
||||
+ */
|
||||
+
|
||||
+ if (type != CUPSD_AUTH_NEGOTIATE)
|
||||
+ {
|
||||
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
# ifdef __APPLE__
|
||||
/*
|
||||
* If the weak-linked GSSAPI/Kerberos library is not present, don't try
|
||||
43
CVE-2025-58364.patch
Normal file
43
CVE-2025-58364.patch
Normal file
@ -0,0 +1,43 @@
|
||||
diff -up cups-2.4.10/cups/ipp.c.cve-2025-58364 cups-2.4.10/cups/ipp.c
|
||||
--- cups-2.4.10/cups/ipp.c.cve-2025-58364 2025-09-05 07:31:10.024210666 +0200
|
||||
+++ cups-2.4.10/cups/ipp.c 2025-09-05 07:33:36.960140431 +0200
|
||||
@@ -2949,31 +2949,6 @@ ippReadIO(void *src, /* I - Data
|
||||
*/
|
||||
|
||||
tag = (ipp_tag_t)buffer[0];
|
||||
- if (tag == IPP_TAG_EXTENSION)
|
||||
- {
|
||||
- /*
|
||||
- * Read 32-bit "extension" tag...
|
||||
- */
|
||||
-
|
||||
- if ((*cb)(src, buffer, 4) < 4)
|
||||
- {
|
||||
- DEBUG_puts("1ippReadIO: Callback returned EOF/error");
|
||||
- goto rollback;
|
||||
- }
|
||||
-
|
||||
- tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
|
||||
-
|
||||
- if (tag & IPP_TAG_CUPS_CONST)
|
||||
- {
|
||||
- /*
|
||||
- * Fail if the high bit is set in the tag...
|
||||
- */
|
||||
-
|
||||
- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
|
||||
- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
|
||||
- goto rollback;
|
||||
- }
|
||||
- }
|
||||
|
||||
if (tag == IPP_TAG_END)
|
||||
{
|
||||
@@ -3196,6 +3171,7 @@ ippReadIO(void *src, /* I - Data
|
||||
|
||||
if ((*cb)(src, buffer, (size_t)n) < n)
|
||||
{
|
||||
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
|
||||
DEBUG_puts("1ippReadIO: unable to read name.");
|
||||
goto rollback;
|
||||
}
|
||||
16
cups.spec
16
cups.spec
@ -22,7 +22,7 @@ Summary: CUPS printing system
|
||||
Name: cups
|
||||
Epoch: 1
|
||||
Version: 2.4.10
|
||||
Release: 11%{?dist}
|
||||
Release: 11%{?dist}.1
|
||||
# backend/failover.c - BSD-3-Clause
|
||||
# cups/md5* - Zlib
|
||||
# scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
|
||||
@ -105,6 +105,10 @@ Patch1011: 0001-scheduler-Clean-up-failed-IPP-Everywhere-permanent-q.patch
|
||||
# 0001-Add-NoSystem-SSLOptions-value.patch
|
||||
Patch1012: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
|
||||
Patch1013: 0001-Add-NoSystem-SSLOptions-value.patch
|
||||
# RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
|
||||
Patch1014: CVE-2025-58060.patch
|
||||
# RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
|
||||
Patch1015: CVE-2025-58364.patch
|
||||
|
||||
|
||||
##### Patches removed because IMHO they aren't no longer needed
|
||||
@ -362,6 +366,10 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
|
||||
%patch -P 1012 -p1 -b .tls-system-policy
|
||||
# give a way how to opt-out from crypto policy
|
||||
%patch -P 1013 -p1 -b .nosystem-ssloption
|
||||
# RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
|
||||
%patch -P 1014 -p1 -b .cve-2025-58060
|
||||
# RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
|
||||
%patch -P 1015 -p1 -b .cve-2025-58364
|
||||
|
||||
|
||||
# Log to the system journal by default (bug #1078781, bug #1519331).
|
||||
@ -831,6 +839,12 @@ rm -f %{cups_serverbin}/backend/smb
|
||||
%{_mandir}/man7/ippeveps.7.gz
|
||||
|
||||
%changelog
|
||||
* Fri Sep 05 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-11.1
|
||||
- RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
|
||||
|
||||
* Thu Sep 04 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-11.1
|
||||
- RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
|
||||
|
||||
* Tue Jan 07 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-11
|
||||
- provide a way how to opt-out from system crypto policy if needed
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user