CUPS 2.4.20 is released!

CUPS 2.4.20 is released!

[Zdenek Dohnal]

Hi all!

CUPS 2.4.20 provides amount of bug fixes and security fixes:

Assigned ids:
- CVE-2025-55480, CVE-2026-61702, CVE-2026-87875, CVE-2026-87876, 
CVE-2026-55453, CVE-2026-55467, CVE-2026-105326

Several fixes use GHSA id, because we changed policy for vulnerabilities 
with CVSS < 7.0 due long waiting time for ids from CNA, which we take as 
lower priority vulnerabilities unless print admin rights are      
required for triggering them, or we explicitly mention the advisory is 
security hardening, and not vulnerability fix.

More details in CHANGES.md.

Enjoy!

-- 
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC

Re: CUPS 2.4.20 is released!

[Matthias Apitz]

Hello,

I fetched 2.4.20 to my server (SUSE Linux Enterprise Server 15 SP7)
configured it with:

gmake clean

export SISISPAP_INSTALL=/usr/local/sisis-pap
export CFLAGS="-m64"
export CXXFLAGS="-m64"
export LDFLAGS="-L$SISISPAP_INSTALL/lib -m64"
export DSOFLAGS="-m64 -L$SISISPAP_INSTALL/lib"
export PKG_CONFIG_PATH=/usr/local/sisis-pap/lib/pkgconfig
#
# because of /usr/bin/pkg-config
#
export LD_LIBRARY_PATH=/usr/lib64:$SISISPAP_INSTALL/lib

./configure --prefix=$SISISPAP_INSTALL/cups2 --libdir=$SISISPAP_INSTALL/cups2/lib \
    --with-cups-user=lp         \
    --with-cups-group=lp        \
    --with-tls=openssl          \
    --with-system-groups=root

The compilation stops in cups/dest.c with:

gmake
...
dest.c: In function ‘cups_enum_dests’:
dest.c:3577:9: error: ‘_cups_getdata_t {aka struct _cups_getdata_s}’ has no member named ‘num_local’
     data.num_local   = 0;
         ^
dest.c:3578:10: error: ‘_cups_getdata_t {aka struct _cups_getdata_s}’ has no member named ‘local_dests’; did you mean ‘num_dests’?
     data.local_dests = NULL;
          ^~~~~~~~~~~
          num_dests

and if I look into cups/dest.c the struct _cups_getdata_t looks indeed
as something else (lines 124...130 of cups/dest.c):

 124 typedef struct _cups_getdata_s
 125 {
 126   int           num_dests;              /* Number of destinations */
 127   cups_dest_t   *dests;                 /* Destinations */
 128   char          def_name[1024],         /* Default printer name, if any */
 129                 *def_instance;          /* Default printer instance, if any      */
 130 } _cups_getdata_t;

What does this mean? Thanks

Btw: I compared cups/dest.c of version 2.4.14 (our current version) and
2.4.20. The reference of the missing struct members is new in 2.4.20:

diff cups-2.4.14/cups/dest.c cups-2.4.20/cups/dest.c
4c4
<  * Copyright © 2020-2025 by OpenPrinting.
---
>  * Copyright © 2020-2026 by OpenPrinting.
...


>     * Get the list of local printers...
3553a3577,3578
>     data.num_local   = 0;
>     data.local_dests = NULL;


	matthias

-- 
Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

I do not want to and will not become fit for war. Merz, go to the
Eastern Front yourself!

Re: CUPS 2.4.20 is released!

[Matthias Apitz]

I had to file the next issue:

https://github.com/OpenPrintingácups/issues/1746
Avahi is not available but cups/dnssd.c tries to use it unconditional

	matthias

-- 
Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

I do not want to and will not become fit for war. Merz, go to the
Eastern Front yourself!

Re: CUPS 2.4.20 is released!

[Matthias Apitz]

Will the official tar archive for 2.4.20 be renewed due to bug #1743?
Thanks

	matthias

-- 
Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

I do not want to and will not become fit for war. Merz, go to the
Eastern Front yourself!