From a4d3bc50e5ea5b96fad1d470d0ac2546a5fd8bcd Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 11 Sep 2025 15:04:03 +0000 Subject: [PATCH] import UBI cups-2.3.3op2-33.el9_6.1 --- SOURCES/CVE-2025-58060.patch | 35 +++++++++++++++++++++++++++ SOURCES/CVE-2025-58364.patch | 46 ++++++++++++++++++++++++++++++++++++ SPECS/cups.spec | 16 ++++++++++++- 3 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 SOURCES/CVE-2025-58060.patch create mode 100644 SOURCES/CVE-2025-58364.patch diff --git a/SOURCES/CVE-2025-58060.patch b/SOURCES/CVE-2025-58060.patch new file mode 100644 index 0000000..3720847 --- /dev/null +++ b/SOURCES/CVE-2025-58060.patch @@ -0,0 +1,35 @@ +diff --git a/scheduler/auth.c b/scheduler/auth.c +index e7d0006..d70e21e 100644 +--- a/scheduler/auth.c ++++ b/scheduler/auth.c +@@ -564,8 +564,12 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */ + switch (type) + { + default : ++ { ++ cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled."); ++ return; ++ } + case CUPSD_AUTH_BASIC : +- { ++ { + #if HAVE_LIBPAM + /* + * Only use PAM to do authentication. This supports MD5 +@@ -737,6 +741,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */ + gss_name_t client_name; /* Client name */ + + ++ /* ++ * Only allow Kerberos if enabled... ++ */ ++ ++ if (type != CUPSD_AUTH_NEGOTIATE) ++ { ++ cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled."); ++ return; ++ } ++ + # ifdef __APPLE__ + /* + * If the weak-linked GSSAPI/Kerberos library is not present, don't try diff --git a/SOURCES/CVE-2025-58364.patch b/SOURCES/CVE-2025-58364.patch new file mode 100644 index 0000000..68796a9 --- /dev/null +++ b/SOURCES/CVE-2025-58364.patch @@ -0,0 +1,46 @@ +diff -up cups-2.3.3op2/cups/ipp.c.cve-2025-58364 cups-2.3.3op2/cups/ipp.c +--- cups-2.3.3op2/cups/ipp.c.cve-2025-58364 2025-09-05 07:36:47.894411883 +0200 ++++ cups-2.3.3op2/cups/ipp.c 2025-09-05 08:16:20.667587236 +0200 +@@ -2951,34 +2951,6 @@ ippReadIO(void *src, /* I - Data + */ + + tag = (ipp_tag_t)buffer[0]; +- if (tag == IPP_TAG_EXTENSION) +- { +- /* +- * Read 32-bit "extension" tag... +- */ +- +- if ((*cb)(src, buffer, 4) < 4) +- { +- DEBUG_puts("1ippReadIO: Callback returned EOF/error"); +- _cupsBufferRelease((char *)buffer); +- return (IPP_STATE_ERROR); +- } +- +- tag = (ipp_tag_t)((((((buffer[0] << 8) | buffer[1]) << 8) | +- buffer[2]) << 8) | buffer[3]); +- +- if (tag & IPP_TAG_CUPS_CONST) +- { +- /* +- * Fail if the high bit is set in the tag... +- */ +- +- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1); +- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag)); +- _cupsBufferRelease((char *)buffer); +- return (IPP_STATE_ERROR); +- } +- } + + if (tag == IPP_TAG_END) + { +@@ -3199,6 +3171,7 @@ ippReadIO(void *src, /* I - Data + + if ((*cb)(src, buffer, (size_t)n) < n) + { ++ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1); + DEBUG_puts("1ippReadIO: unable to read name."); + _cupsBufferRelease((char *)buffer); + return (IPP_STATE_ERROR); diff --git a/SPECS/cups.spec b/SPECS/cups.spec index a2b08f0..0bc3a00 100644 --- a/SPECS/cups.spec +++ b/SPECS/cups.spec @@ -24,7 +24,7 @@ Summary: CUPS printing system Name: cups Epoch: 1 Version: 2.3.3%{OP_VER} -Release: 33%{?dist} +Release: 33%{?dist}.1 License: ASL 2.0 Url: http://www.cups.org/ # Apple stopped uploading the new versions into github, use OpenPrinting fork @@ -161,6 +161,10 @@ Patch49: 0001-fix-warnings-for-unused-vars.patch # 0001-Add-NoSystem-SSLOptions-value.patch Patch50: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch Patch51: 0001-Add-NoSystem-SSLOptions-value.patch +# RHEL-112438 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling +Patch52: CVE-2025-58060.patch +# RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +Patch53: CVE-2025-58364.patch ##### Patches removed because IMHO they aren't no longer needed @@ -448,6 +452,10 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in # RHEL-68414 Inability to disable weak ciphers in CUPS configuration %patch50 -p1 -b .tls-system %patch51 -p1 -b .ssl-nosystem +# RHEL-112438 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling +%patch52 -p1 -b .cve-2025-58060 +# RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS +%patch53 -p1 -b .cve-2025-58364 %if %{lspp} @@ -913,6 +921,12 @@ rm -f %{cups_serverbin}/backend/smb %{_mandir}/man7/ippeveps.7.gz %changelog +* Fri Sep 05 2025 Zdenek Dohnal - 1.2.3.3op2-33.1 +- RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS + +* Thu Sep 04 2025 Zdenek Dohnal - 1.2.3.3op2-33.1 +- RHEL-112438 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling + * Wed Jan 08 2025 Zdenek Dohnal - 1:2.3.3op2-33 - Add NoSystem SSLOptions value