From 52a0b3b46e6d9e17a8b576a7496ea3c670cd5cec Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 11 Sep 2025 17:50:55 +0000 Subject: [PATCH] import UBI cups-2.4.10-11.el10_0.1 --- CVE-2025-58060.patch | 46 ++++++++++++++++++++++++++++++++++++++++++++ CVE-2025-58364.patch | 43 +++++++++++++++++++++++++++++++++++++++++ cups.spec | 16 ++++++++++++++- 3 files changed, 104 insertions(+), 1 deletion(-) create mode 100644 CVE-2025-58060.patch create mode 100644 CVE-2025-58364.patch diff --git a/CVE-2025-58060.patch b/CVE-2025-58060.patch new file mode 100644 index 0000000..5acbca4 --- /dev/null +++ b/CVE-2025-58060.patch @@ -0,0 +1,46 @@ +diff --git a/scheduler/auth.c b/scheduler/auth.c +index 5fa53644d..3c9aa72aa 100644 +--- a/scheduler/auth.c ++++ b/scheduler/auth.c +@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */ + int userlen; /* Username:password length */ + + ++ /* ++ * Only allow Basic if enabled... ++ */ ++ ++ if (type != CUPSD_AUTH_BASIC) ++ { ++ cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled."); ++ return; ++ } ++ + authorization += 5; + while (isspace(*authorization & 255)) + authorization ++; +@@ -558,7 +568,6 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */ + * Validate the username and password... + */ + +- if (type == CUPSD_AUTH_BASIC) + { + #if HAVE_LIBPAM + /* +@@ -727,6 +736,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */ + /* Output token for username */ + gss_name_t client_name; /* Client name */ + ++ /* ++ * Only allow Kerberos if enabled... ++ */ ++ ++ if (type != CUPSD_AUTH_NEGOTIATE) ++ { ++ cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled."); ++ return; ++ } ++ + # ifdef __APPLE__ + /* + * If the weak-linked GSSAPI/Kerberos library is not present, don't try diff --git a/CVE-2025-58364.patch b/CVE-2025-58364.patch new file mode 100644 index 0000000..d535b0d --- /dev/null +++ b/CVE-2025-58364.patch @@ -0,0 +1,43 @@ +diff -up cups-2.4.10/cups/ipp.c.cve-2025-58364 cups-2.4.10/cups/ipp.c +--- cups-2.4.10/cups/ipp.c.cve-2025-58364 2025-09-05 07:31:10.024210666 +0200 ++++ cups-2.4.10/cups/ipp.c 2025-09-05 07:33:36.960140431 +0200 +@@ -2949,31 +2949,6 @@ ippReadIO(void *src, /* I - Data + */ + + tag = (ipp_tag_t)buffer[0]; +- if (tag == IPP_TAG_EXTENSION) +- { +- /* +- * Read 32-bit "extension" tag... +- */ +- +- if ((*cb)(src, buffer, 4) < 4) +- { +- DEBUG_puts("1ippReadIO: Callback returned EOF/error"); +- goto rollback; +- } +- +- tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]); +- +- if (tag & IPP_TAG_CUPS_CONST) +- { +- /* +- * Fail if the high bit is set in the tag... +- */ +- +- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1); +- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag)); +- goto rollback; +- } +- } + + if (tag == IPP_TAG_END) + { +@@ -3196,6 +3171,7 @@ ippReadIO(void *src, /* I - Data + + if ((*cb)(src, buffer, (size_t)n) < n) + { ++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1); + DEBUG_puts("1ippReadIO: unable to read name."); + goto rollback; + } diff --git a/cups.spec b/cups.spec index c60a493..499d4c2 100644 --- a/cups.spec +++ b/cups.spec @@ -22,7 +22,7 @@ Summary: CUPS printing system Name: cups Epoch: 1 Version: 2.4.10 -Release: 11%{?dist} +Release: 11%{?dist}.1 # backend/failover.c - BSD-3-Clause # cups/md5* - Zlib # scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause @@ -105,6 +105,10 @@ Patch1011: 0001-scheduler-Clean-up-failed-IPP-Everywhere-permanent-q.patch # 0001-Add-NoSystem-SSLOptions-value.patch Patch1012: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch Patch1013: 0001-Add-NoSystem-SSLOptions-value.patch +# RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling +Patch1014: CVE-2025-58060.patch +# RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +Patch1015: CVE-2025-58364.patch ##### Patches removed because IMHO they aren't no longer needed @@ -362,6 +366,10 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in %patch -P 1012 -p1 -b .tls-system-policy # give a way how to opt-out from crypto policy %patch -P 1013 -p1 -b .nosystem-ssloption +# RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling +%patch -P 1014 -p1 -b .cve-2025-58060 +# RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +%patch -P 1015 -p1 -b .cve-2025-58364 # Log to the system journal by default (bug #1078781, bug #1519331). @@ -831,6 +839,12 @@ rm -f %{cups_serverbin}/backend/smb %{_mandir}/man7/ippeveps.7.gz %changelog +* Fri Sep 05 2025 Zdenek Dohnal - 1:2.4.10-11.1 +- RHEL-113075 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS + +* Thu Sep 04 2025 Zdenek Dohnal - 1:2.4.10-11.1 +- RHEL-112421 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling + * Tue Jan 07 2025 Zdenek Dohnal - 1:2.4.10-11 - provide a way how to opt-out from system crypto policy if needed