mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-26 23:00:13 +00:00
Code Issues Projects Releases Wiki Activity

cups: fix CVE-2026-34978

Browse Source 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/730347c5bbd5e1271149c6739aa858c0c83a7568
[2] https://security-tracker.debian.org/tracker/CVE-2026-34978

(From OE-Core rev: 511d976c70fb591f3bc72b750df1542c4ee84d6a)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
[YC: reverted upstream patch indentation]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore
2026-07-30 13:21:15 +01:00
committed by Paul Barker
parent 8b7ff1d843
commit 9184e90773
2 changed files with 108 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/cups/cups.inc
+1
View File
@@ -24,6 +24,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/cups-${PV}-source.tar.gz \
file://CVE-2026-27447-regression_p1.patch \
file://CVE-2026-27447-regression_p2.patch \
file://CVE-2026-41079.patch \
file://CVE-2026-34978.patch \
"
GITHUB_BASE_URI = "https://github.com/OpenPrinting/cups/releases"
meta/recipes-extended/cups/cups/CVE-2026-34978.patch
+107
View File
@@ -0,0 +1,107 @@
From ab6ab965de6890aed4df39c97f7cd708fd5cb00c Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 31 Mar 2026 14:18:26 -0400
Subject: [PATCH] Fix RSS notifier.
CVE: CVE-2026-34978
Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/730347c5bbd5e1271149c6739aa858c0c83a7568]
Backport Changes:
- Rebase scheduler/ipp.c subscription context to the CUPS 2.4.11 source
carried by this recipe.
- Omit the upstream CHANGES.md release-note hunk because Yocto patch metadata
carries the CVE details and the target source release-note sections differ.
- Omit the upstream scheduler/ipp.c copyright-year-only header update because
this backport carries only the functional changes needed for CUPS 2.4.11.
(cherry picked from commit 730347c5bbd5e1271149c6739aa858c0c83a7568)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
notifier/rss.c | 20 ++++++++++++++------
scheduler/ipp.c | 12 ++++++++++++
2 files changed, 26 insertions(+), 6 deletions(-)
diff --git a/notifier/rss.c b/notifier/rss.c
index f17e1494c..250ad877e 100644
--- a/notifier/rss.c
+++ b/notifier/rss.c
@@ -1,11 +1,12 @@
/*
* RSS notifier for CUPS.
*
- * Copyright © 2020-2024 by OpenPrinting.
- * Copyright 2007-2015 by Apple Inc.
- * Copyright 2007 by Easy Software Products.
+ * Copyright © 2020-2026 by OpenPrinting.
+ * Copyright © 2007-2015 by Apple Inc.
+ * Copyright © 2007 by Easy Software Products.
*
- * Licensed under Apache License v2.0. See the file "LICENSE" for more information.
+ * Licensed under Apache License v2.0. See the file "LICENSE" for more
+ * information.
*/
/*
@@ -80,6 +81,7 @@ main(int argc, /* I - Number of command-line arguments */
http_status_t status; /* HTTP GET/PUT status code */
char filename[1024], /* Local filename */
newname[1024]; /* filename.N */
+ struct stat fileinfo; /* Local file information */
cups_lang_t *language; /* Language information */
ipp_attribute_t *printer_up_time, /* Timestamp on event */
*notify_sequence_number,/* Sequence number */
@@ -111,9 +113,9 @@ main(int argc, /* I - Number of command-line arguments */
if (httpSeparateURI(HTTP_URI_CODING_ALL, argv[1], scheme, sizeof(scheme),
username, sizeof(username), host, sizeof(host), &port,
- resource, sizeof(resource)) < HTTP_URI_OK)
+ resource, sizeof(resource)) < HTTP_URI_OK || strstr(resource, "../") != NULL)
{
- fprintf(stderr, "ERROR: Bad RSS URI \"%s\"!\n", argv[1]);
+ fprintf(stderr, "ERROR: Bad RSS URI \"%s\".\n", argv[1]);
return (1);
}
@@ -209,6 +211,12 @@ main(int argc, /* I - Number of command-line arguments */
snprintf(filename, sizeof(filename), "%s/rss%s", cachedir, resource);
snprintf(newname, sizeof(newname), "%s.N", filename);
+ if (!lstat(filename, &fileinfo) && !S_ISREG(fileinfo.st_mode))
+ {
+ fprintf(stderr, "ERROR: Local RSS path \"%s\" is not a file.\n", filename);
+ return (1);
+ }
+
httpAssembleURIf(HTTP_URI_CODING_ALL, baseurl, sizeof(baseurl), "http",
NULL, server_name, atoi(server_port), "/rss%s", resource);
}
diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index 2d80a960e..2dc7376c1 100644
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -1985,6 +1985,12 @@ add_job_subscriptions(
"notify-status-code", IPP_ATTRIBUTES);
return;
}
+ else if (!strcmp(scheme, "rss") && strstr(resource, "../") != NULL)
+ {
+ send_ipp_status(con, IPP_STATUS_ERROR_NOT_POSSIBLE, _("Bad notify-recipient-uri URI \"%s\"."), recipient);
+ ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM, "notify-status-code", IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES);
+ return;
+ }
}
else if (!strcmp(attr->name, "notify-pull-method") &&
attr->value_tag == IPP_TAG_KEYWORD)
@@ -6010,6 +6016,12 @@ create_subscriptions(
"notify-status-code", IPP_ATTRIBUTES);
return;
}
+ else if (!strcmp(scheme, "rss") && strstr(resource, "../") != NULL)
+ {
+ send_ipp_status(con, IPP_STATUS_ERROR_NOT_POSSIBLE, _("Bad notify-recipient-uri URI \"%s\"."), recipient);
+ ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM, "notify-status-code", IPP_STATUS_ERROR_ATTRIBUTES_OR_VALUES);
+ return;
+ }
}
else if (!strcmp(attr->name, "notify-pull-method") &&
attr->value_tag == IPP_TAG_KEYWORD)