rpms/cups
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling

Browse Source 
Resolves: RHEL-112435
This commit is contained in:
Zdenek Dohnal 2025-09-11 14:30:30 +02:00
parent bbcbd9293b
commit 707aa91a75
2 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
CVE-2025-58060.patch Normal file
View File

@ -0,0 +1,35 @@
diff --git a/scheduler/auth.c b/scheduler/auth.c
index e7d0006..d70e21e 100644
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -564,8 +564,12 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
switch (type)
{
default :
+ {
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
+ return;
+ }
case CUPSD_AUTH_BASIC :
- {
+ {
#if HAVE_LIBPAM
/*
* Only use PAM to do authentication. This supports MD5
@@ -737,6 +741,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
gss_name_t client_name; /* Client name */
+ /*
+ * Only allow Kerberos if enabled...
+ */
+
+ if (type != CUPSD_AUTH_NEGOTIATE)
+ {
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
+ return;
+ }
+
# ifdef __APPLE__
/*
* If the weak-linked GSSAPI/Kerberos library is not present, don't try

9
cups.spec
View File

@ -24,7 +24,7 @@ Summary: CUPS printing system
Name: cups
Epoch: 1
Version: 2.3.3%{OP_VER}
Release: 33%{?dist}
Release: 34%{?dist}
License: ASL 2.0
Url: http://www.cups.org/
# Apple stopped uploading the new versions into github, use OpenPrinting fork
@ -161,6 +161,8 @@ Patch49: 0001-fix-warnings-for-unused-vars.patch
# 0001-Add-NoSystem-SSLOptions-value.patch
Patch50: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
Patch51: 0001-Add-NoSystem-SSLOptions-value.patch
# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
Patch52: CVE-2025-58060.patch
##### Patches removed because IMHO they aren't no longer needed
@ -448,6 +450,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
# RHEL-68414 Inability to disable weak ciphers in CUPS configuration
%patch50 -p1 -b .tls-system
%patch51 -p1 -b .ssl-nosystem
# RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
%patch52 -p1 -b .cve-2025-58060
%if %{lspp}
@ -913,6 +917,9 @@ rm -f %{cups_serverbin}/backend/smb
%{_mandir}/man7/ippeveps.7.gz
%changelog
* Thu Sep 11 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
- RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
* Wed Jan 08 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-33
- Add NoSystem SSLOptions value