mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-17 05:37:02 +00:00
Code Issues Projects Releases Wiki Activity

cups: fix CVE-2026-34990

Browse Source 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/e052dc44da9d12adfbebc51de4975fbadb2ce356
[2] https://security-tracker.debian.org/tracker/CVE-2026-34990

(From OE-Core rev: 5bf5d3da45fcc1494e5e6b3acf23880982518a7b)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore authored and Paul Barker committed 2026-07-30 13:21:15 +01:00
1 parent 6fa69de2bc
commit 4ae1f9aec6
2 files changed
+352
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-extended/cups/cups.inc
+1
View File
@@ -29,6 +29,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
file://CVE-2026-34980-regression_p1.patch \
file://CVE-2026-34980-regression_p2.patch \
file://CVE-2026-34979.patch \
file://CVE-2026-34990.patch \
"
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
meta/recipes-extended/cups/cups/CVE-2026-34990.patch
+351
View File
@@ -0,0 +1,351 @@
From 48648896ca7faa8f105eee7b7a8d86c42e0fa796 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 31 Mar 2026 15:55:50 -0400
Subject: [PATCH] Don't allow local certificates over the loopback
interface, drop support for writing to plain files.
CVE: CVE-2026-34990
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/e052dc44da9d12adfbebc51de4975fbadb2ce356]
Backport Changes:
- Preserve the existing CVE-2025-61915 PeerCred disable guard while changing
localhost checks to AF_LOCAL.
- Keep the CUPS 2.4.11 empty device-uri validation path separate and add a
dedicated rejection for non-IPP/IPPS schemes instead of folding both checks
into one upstream condition.
- Omit the upstream CHANGES.md release-note hunk because Yocto patch metadata
carries the CVE details and the target source release-note sections differ.
(cherry picked from commit e052dc44da9d12adfbebc51de4975fbadb2ce356)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
cups/auth.c | 30 ++++++--------------------
scheduler/auth.c | 9 ++++----
scheduler/client.c | 4 +--
scheduler/ipp.c | 8 ++++++-
scheduler/job.c | 46 ++++++++++++++++++++++-------------------
test/4.2-cups-printer-ops.test | 6 ++---
test/5.1-lpadmin.sh | 14 ++++++------
7 files changed, 56 insertions(+), 61 deletions(-)
diff --git a/cups/auth.c b/cups/auth.c
index 5cb4194..14661c7 100644
--- a/cups/auth.c
+++ b/cups/auth.c
@@ -1,7 +1,7 @@
/*
* Authentication functions for CUPS.
*
- * Copyright © 2020-2024 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
* Copyright © 2007-2019 by Apple Inc.
* Copyright © 1997-2007 by Easy Software Products.
*
@@ -92,7 +92,6 @@ static void cups_gss_printf(OM_uint32 major_status, OM_uint32 minor_status,
# define cups_gss_printf(major, minor, message)
# endif /* DEBUG */
#endif /* HAVE_GSSAPI */
-static int cups_is_local_connection(http_t *http);
static int cups_local_auth(http_t *http);
@@ -948,14 +947,6 @@ cups_gss_printf(OM_uint32 major_status,/* I - Major status code */
# endif /* DEBUG */
#endif /* HAVE_GSSAPI */
-static int /* O - 0 if not a local connection */
- /* 1 if local connection */
-cups_is_local_connection(http_t *http) /* I - HTTP connection to server */
-{
- if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0)
- return 0;
- return 1;
-}
/*
* 'cups_local_auth()' - Get the local authorization certificate if
@@ -967,13 +958,7 @@ static int /* O - 0 if available */
/* -1 error */
cups_local_auth(http_t *http) /* I - HTTP connection to server */
{
-#if defined(_WIN32) || defined(__EMX__)
- /*
- * Currently _WIN32 and OS-2 do not support the CUPS server...
- */
-
- return (1);
-#else
+#if !_WIN32 && !__EMX__ && defined(AF_LOCAL)
int pid; /* Current process ID */
FILE *fp; /* Certificate file */
char trc[16], /* Try Root Certificate parameter */
@@ -998,7 +983,7 @@ cups_local_auth(http_t *http) /* I - HTTP connection to server */
* See if we are accessing localhost...
*/
- if (!cups_is_local_connection(http))
+ if (httpAddrFamily(httpGetAddress(http)) != AF_LOCAL)
{
DEBUG_puts("8cups_local_auth: Not a local connection!");
return (1);
@@ -1072,15 +1057,14 @@ cups_local_auth(http_t *http) /* I - HTTP connection to server */
}
# endif /* HAVE_AUTHORIZATION_H */
-# if defined(SO_PEERCRED) && defined(AF_LOCAL)
+# ifdef SO_PEERCRED
/*
* See if we can authenticate using the peer credentials provided over a
* domain socket; if so, specify "PeerCred username" as the authentication
* information...
*/
- if (http->hostaddr->addr.sa_family == AF_LOCAL &&
- !getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */
+ if (!getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */
cups_auth_find(www_auth, "PeerCred"))
{
/*
@@ -1104,7 +1088,7 @@ cups_local_auth(http_t *http) /* I - HTTP connection to server */
return (0);
}
}
-# endif /* SO_PEERCRED && AF_LOCAL */
+# endif /* SO_PEERCRED */
if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL)
return (1);
@@ -1164,7 +1148,7 @@ cups_local_auth(http_t *http) /* I - HTTP connection to server */
return (0);
}
}
+#endif /* !_WIN32 && !__EMX__ && AF_LOCAL */
return (1);
-#endif /* _WIN32 || __EMX__ */
}
diff --git a/scheduler/auth.c b/scheduler/auth.c
index 1dd520d..56855fc 100644
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -318,7 +318,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
}
#ifdef HAVE_AUTHORIZATION_H
else if (!strncmp(authorization, "AuthRef ", 8) &&
- httpAddrLocalhost(httpGetAddress(con->http)))
+ httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL)
{
OSStatus status; /* Status */
char authdata[HTTP_MAX_VALUE];
@@ -399,7 +399,8 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
#endif /* HAVE_AUTHORIZATION_H */
#if defined(SO_PEERCRED) && defined(AF_LOCAL)
- else if (PeerCred != CUPSD_PEERCRED_OFF && !strncmp(authorization, "PeerCred ", 9) &&
- con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best)
+ else if (PeerCred != CUPSD_PEERCRED_OFF &&
+ !strncmp(authorization, "PeerCred ", 9) &&
+ httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL && con->best)
{
/*
* Use peer credentials from domain socket connection...
@@ -483,7 +483,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
}
#endif /* SO_PEERCRED && AF_LOCAL */
else if (!strncmp(authorization, "Local", 5) &&
- httpAddrLocalhost(httpGetAddress(con->http)))
+ httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL)
{
/*
* Get Local certificate authentication data...
diff --git a/scheduler/client.c b/scheduler/client.c
index 779404c..dea9da0 100644
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -2173,7 +2173,7 @@ cupsdSendHeader(
strlcpy(auth_str, "Negotiate", sizeof(auth_str));
}
- if (con->best && !con->is_browser && !_cups_strcasecmp(httpGetHostname(con->http, NULL, 0), "localhost"))
+ if (con->best && !con->is_browser && httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL)
{
/*
* Add a "trc" (try root certification) parameter for local
@@ -2193,7 +2193,7 @@ cupsdSendHeader(
auth_size = sizeof(auth_str) - (size_t)(auth_key - auth_str);
#if defined(SO_PEERCRED) && defined(AF_LOCAL)
- if (PeerCred != CUPSD_PEERCRED_OFF && httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL)
+ if (PeerCred != CUPSD_PEERCRED_OFF)
{
strlcpy(auth_key, ", PeerCred", auth_size);
auth_key += 10;
diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index b0d1f5b..11dcd39 100644
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -5561,7 +5561,7 @@ create_local_printer(
* Require local access to create a local printer...
*/
- if (!httpAddrLocalhost(httpGetAddress(con->http)))
+ if (httpAddrFamily(httpGetAddress(con->http)) != AF_LOCAL)
{
send_ipp_status(con, IPP_STATUS_ERROR_FORBIDDEN, _("Only local users can create a local printer."));
return;
@@ -5634,6 +5634,12 @@ create_local_printer(
return;
}
+ else if (strncmp(ptr, "ipp://", 6) && strncmp(ptr, "ipps://", 7))
+ {
+ send_ipp_status(con, IPP_STATUS_ERROR_NOT_POSSIBLE, _("Bad device-uri \"%s\"."), ptr);
+
+ return;
+ }
printer_geo_location = ippFindAttribute(con->request, "printer-geo-location", IPP_TAG_URI);
printer_info = ippFindAttribute(con->request, "printer-info", IPP_TAG_TEXT);
diff --git a/scheduler/job.c b/scheduler/job.c
index 880c25f..6c033de 100644
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -1164,35 +1164,39 @@ cupsdContinueJob(cupsd_job_t *job) /* I - Job */
}
else
{
+ char scheme[32], /* URI scheme */
+ userpass[32], /* URI username:password */
+ host[256], /* URI hostname */
+ resource[1024]; /* URI resource path (filename) */
+ int port; /* URI port number */
+
+ httpSeparateURI(HTTP_URI_CODING_ALL, job->printer->device_uri, scheme, sizeof(scheme), userpass, sizeof(userpass), host, sizeof(host), &port, resource, sizeof(resource));
+
job->print_pipes[0] = -1;
- if (!strcmp(job->printer->device_uri, "file:/dev/null") ||
- !strcmp(job->printer->device_uri, "file:///dev/null"))
- job->print_pipes[1] = -1;
- else
+ job->print_pipes[1] = -1;
+
+ if (strcmp(resource, "/dev/null"))
{
- if (!strncmp(job->printer->device_uri, "file:/dev/", 10))
- job->print_pipes[1] = open(job->printer->device_uri + 5,
- O_WRONLY | O_EXCL);
- else if (!strncmp(job->printer->device_uri, "file:///dev/", 12))
- job->print_pipes[1] = open(job->printer->device_uri + 7,
- O_WRONLY | O_EXCL);
- else if (!strncmp(job->printer->device_uri, "file:///", 8))
- job->print_pipes[1] = open(job->printer->device_uri + 7,
- O_WRONLY | O_CREAT | O_TRUNC, 0600);
- else
- job->print_pipes[1] = open(job->printer->device_uri + 5,
- O_WRONLY | O_CREAT | O_TRUNC, 0600);
+ if (!FileDevice)
+ {
+ abort_message = "Stopping job because file: output is disabled.";
- if (job->print_pipes[1] < 0)
+ goto abort_job;
+ }
+ else if ((job->print_pipes[1] = open(resource, O_WRONLY | O_EXCL)) < 0)
{
- abort_message = "Stopping job because the scheduler could not "
- "open the output file.";
+ abort_message = "Stopping job because the scheduler could not open the output file.";
goto abort_job;
}
+ else
+ {
+ /*
+ * Close this file on execute...
+ */
- fcntl(job->print_pipes[1], F_SETFD,
- fcntl(job->print_pipes[1], F_GETFD) | FD_CLOEXEC);
+ fcntl(job->print_pipes[1], F_SETFD, fcntl(job->print_pipes[1], F_GETFD) | FD_CLOEXEC);
+ }
}
}
}
diff --git a/test/4.2-cups-printer-ops.test b/test/4.2-cups-printer-ops.test
index 1a011e0..945a9bb 100644
--- a/test/4.2-cups-printer-ops.test
+++ b/test/4.2-cups-printer-ops.test
@@ -1,7 +1,7 @@
#
# Verify that the CUPS printer operations work.
#
-# Copyright © 2020-2024 by OpenPrinting.
+# Copyright © 2020-2026 by OpenPrinting.
# Copyright © 2007-2019 by Apple Inc.
# Copyright © 2001-2006 by Easy Software Products. All rights reserved.
#
@@ -180,7 +180,7 @@
ATTR uri printer-uri $method://$hostname:$port/printers/Test2
GROUP printer
- ATTR uri device-uri file:/tmp/Test2
+ ATTR uri device-uri file:///dev/null
ATTR enum printer-state 3
ATTR boolean printer-is-accepting-jobs true
@@ -206,7 +206,7 @@
ATTR uri printer-uri $method://$hostname:$port/printers/Test1
GROUP printer
- ATTR uri device-uri file:/tmp/Test1
+ ATTR uri device-uri file:///dev/null
ATTR enum printer-state 3
ATTR boolean printer-is-accepting-jobs true
ATTR text printer-info "Test Printer 1"
diff --git a/test/5.1-lpadmin.sh b/test/5.1-lpadmin.sh
index aa39800..36f2822 100644
--- a/test/5.1-lpadmin.sh
+++ b/test/5.1-lpadmin.sh
@@ -2,7 +2,7 @@
#
# Test the lpadmin command.
#
-# Copyright © 2020-2024 by OpenPrinting.
+# Copyright © 2020-2026 by OpenPrinting.
# Copyright © 2007-2018 by Apple Inc.
# Copyright © 1997-2005 by Easy Software Products, all rights reserved.
#
@@ -12,8 +12,8 @@
echo "Add Printer Test"
echo ""
-echo " lpadmin -p Test3 -v file:/dev/null -E -m drv:///sample.drv/deskjet.ppd"
-$runcups $VALGRIND ../systemv/lpadmin -p Test3 -v file:/dev/null -E -m drv:///sample.drv/deskjet.ppd 2>&1
+echo " lpadmin -p Test3 -v file:///dev/null -E -m drv:///sample.drv/deskjet.ppd"
+$runcups $VALGRIND ../systemv/lpadmin -p Test3 -v file:///dev/null -E -m drv:///sample.drv/deskjet.ppd 2>&1
if test $? != 0; then
echo " FAILED"
exit 1
@@ -29,8 +29,8 @@ echo ""
echo "Modify Printer Test"
echo ""
-echo " lpadmin -p Test3 -v file:/tmp/Test3 -o PageSize=A4"
-$runcups $VALGRIND ../systemv/lpadmin -p Test3 -v file:/tmp/Test3 -o PageSize=A4 2>&1
+echo " lpadmin -p Test3 -v file:///dev/null -o PageSize=A4"
+$runcups $VALGRIND ../systemv/lpadmin -p Test3 -v file:///dev/null -o PageSize=A4 2>&1
if test $? != 0; then
echo " FAILED"
exit 1
@@ -65,8 +65,8 @@ echo ""
echo "Add a printer for cupSNMP/IPPSupplies test"
echo ""
-echo " lpadmin -p Test4 -E -v file:/dev/null -m drv:///sample.drv/zebra.ppd"
-$runcups $VALGRIND ../systemv/lpadmin -p Test4 -E -v file:/dev/null -m drv:///sample.drv/zebra.ppd 2>&1
+echo " lpadmin -p Test4 -E -v file:///dev/null -m drv:///sample.drv/zebra.ppd"
+$runcups $VALGRIND ../systemv/lpadmin -p Test4 -E -v file:///dev/null -m drv:///sample.drv/zebra.ppd 2>&1
if test $? != 0; then
echo " FAILED"
exit 1
--
2.43.7