mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-20 23:39:22 +00:00
Code Issues Projects Releases Wiki Activity

cups: Fix for CVE-2025-58060 and CVE-2025-58364

Browse Source 
import patch from debian to fix
  CVE-2025-58060
  CVE-2025-58364

Upstream-Status: Backport [import from debian cups 2.4.2-3+deb12u9
Upstream commit
595d691075
&
e58cba9d6f]

(From OE-Core rev: 88585645a041c3c2ee7b39bf5f72885ed7c8775f)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
2025-09-17 08:17:00 +05:30
committed by Steve Sakoman
parent 6d64cdb02b
commit 9e8df15269
3 changed files with 141 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-extended/cups/cups.inc
View File

@@ -25,6 +25,8 @@ SRC_URI = "https://github.com/OpenPrinting/cups/releases/download/v${PV}/cups-${
file://CVE-2024-47175-3.patch \
file://CVE-2024-47175-4.patch \
file://CVE-2024-47175-5.patch \
file://CVE-2025-58060.patch \
file://CVE-2025-58364.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/OpenPrinting/cups/releases"

76
meta/recipes-extended/cups/cups/CVE-2025-58060.patch Normal file
View File

@@ -0,0 +1,76 @@
From 595d691075b1d396d2edfaa0a8fd0873a0a1f221 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 11 Sep 2025 14:44:59 +0200
Subject: [PATCH] cupsd: Block authentication using alternate method
Fixes: CVE-2025-58060
Upstream-Status: Backport [import from debian 2.4.2-3+deb12u9
Upstream commit https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221]
CVE: CVE-2025-58060
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
scheduler/auth.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/scheduler/auth.c b/scheduler/auth.c
index aa773f9..55f8912 100644
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
int userlen; /* Username:password length */
+ /*
+ * Only allow Basic if enabled...
+ */
+
+ if (type != CUPSD_AUTH_BASIC)
+ {
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
+ return;
+ }
+
authorization += 5;
while (isspace(*authorization & 255))
authorization ++;
@@ -558,10 +568,6 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
* Validate the username and password...
*/
- switch (type)
- {
- default :
- case CUPSD_AUTH_BASIC :
{
#if HAVE_LIBPAM
/*
@@ -715,8 +721,6 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
}
cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
- break;
- }
con->type = type;
}
@@ -733,6 +737,16 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
/* Output token for username */
gss_name_t client_name; /* Client name */
+ /*
+ * Only allow Kerberos if enabled...
+ */
+
+ if (type != CUPSD_AUTH_NEGOTIATE)
+ {
+ cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
+ return;
+ }
+
# ifdef __APPLE__
/*
* If the weak-linked GSSAPI/Kerberos library is not present, don't try
--
2.25.1

63
meta/recipes-extended/cups/cups/CVE-2025-58364.patch Normal file
View File

@@ -0,0 +1,63 @@
From e58cba9d6fceed4242980e51dbd1302cf638ab1d Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 11 Sep 2025 14:53:49 +0200
Subject: [PATCH] libcups: Fix handling of extension tag in `ipp_read_io()`
Fixes: CVE-2025-58364
Upstream-Status: Backport [import from debian 2.4.2-3+deb12u9
Upstream commit https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d]
CVE: CVE-2025-58364
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
cups/ipp.c | 27 +--------------------------
1 file changed, 1 insertion(+), 26 deletions(-)
diff --git a/cups/ipp.c b/cups/ipp.c
index 42cf2fc..4b9dc4e 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -2949,32 +2949,6 @@ ippReadIO(void *src, /* I - Data source */
*/
tag = (ipp_tag_t)buffer[0];
- if (tag == IPP_TAG_EXTENSION)
- {
- /*
- * Read 32-bit "extension" tag...
- */
-
- if ((*cb)(src, buffer, 4) < 4)
- {
- DEBUG_puts("1ippReadIO: Callback returned EOF/error");
- goto rollback;
- }
-
- tag = (ipp_tag_t)((((((buffer[0] << 8) | buffer[1]) << 8) |
- buffer[2]) << 8) | buffer[3]);
-
- if (tag & IPP_TAG_CUPS_CONST)
- {
- /*
- * Fail if the high bit is set in the tag...
- */
-
- _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
- DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
- goto rollback;
- }
- }
if (tag == IPP_TAG_END)
{
@@ -3323,6 +3297,7 @@ ippReadIO(void *src, /* I - Data source */
{
if ((*cb)(src, buffer, (size_t)n) < n)
{
+ _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
DEBUG_puts("1ippReadIO: unable to read string value.");
goto rollback;
}
--
2.25.1