Re: [Buildroot] [PATCH 1/1] package/cups: security bump to v2.4.20

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Sun, Oct 25, 2026 at 06:48:35PM +0100, Thomas Perale via buildroot wrote:
> See the release note:
> 
> - https://github.com/OpenPrinting/cups/releases/tag/v2.4.20
> 
> The additional patch is required to fix the build with the option
> `--with-dnssd=no`. This build error can be triggered by not enabling the
> package `BR2_PACKAGE_AVAHI_LIBAVAHI_CLIENT` [1].
> 
> Fixes the following vulnerabilities:
> 
> - CVE-2026-55453:
>     OpenPrinting CUPS is an open source printing system for Linux and
>     other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c
>     quote_string() function preserves carriage-return and line-feed
>     characters in a remote printer-controlled marker-message before
>     report_attr() writes the value to the scheduler status stream. The
>     scheduler can parse an injected newline as a separate PPD: control
>     line and persist an attacker-selected PPD keyword. The reporter
>     demonstrated that a later print job on a Foomatic-backed queue could
>     consume an injected FoomaticRIPCommandLine value and execute in the
>     filter context as lp.
>     https://www.cve.org/CVERecord?id=CVE-2026-55453
> 
> - CVE-2026-55467:
>     OpenPrinting CUPS is an open source printing system for Linux and
>     other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob
>     option-string builder in scheduler/job.c maps attacker-controlled
>     destination-uri and pre-dial-string values from a configured fax queue
>     to the phone and faxPrefix options. Unlike ordinary IPP job
>     attributes, these mapped fax values bypass the control-character
>     sanitizer and are copied directly into the filter options argument. A
>     user permitted to submit a job can therefore inject control characters
>     into the downstream option stream. The reporter states that a
>     downstream fax filter passing these values to a shell or modem command
>     could execute code as lp, while the maintainer states that CUPS has no
>     confidentiality or integrity impact because the only known code-
>     executing filter is optional Foomatic and addressed separately,
>     leaving possible disruption of the affected queue.
>     https://www.cve.org/CVERecord?id=CVE-2026-55467
> 
> - CVE-2026-55480:
>     OpenPrinting CUPS is an open source printing system for Linux and
>     other Unix-like operating systems. Prior to 2.4.20, copy_model() in
>     scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd
>     path in an lp-group-writable directory and opens it as root without
>     O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able
>     to write that directory to predict the connection-derived name and
>     plant a symlink before the root open, while a privileged add-printer
>     or modify-printer operation using a model PPD triggers copy_model().
>     The reporter treats an existing lp foothold and the privileged
>     operation as distinct prerequisites, while the maintainer assesses
>     high privileges because installing the relevant filter or
>     administering the printer requires root or print-administrator access.
>     If the race succeeds, the root scheduler follows the symlink and
>     truncates or overwrites a root-writable target with generated PPD
>     data, compromising file integrity or availability.
>     https://www.cve.org/CVERecord?id=CVE-2026-55480
> 
> - CVE-2026-61702:
>     OpenPrinting CUPS is an open source printing system for Linux and
>     other Unix-like operating systems. Prior to 2.4.20, copy_banner() in
>     scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-
>     language value as a directory component beneath DataDir/banners when
>     processing a job-sheets banner. The job-sheets value must first match
>     a registered banner basename, and the traversed path must contain a
>     matching reachable basename; selecting an arbitrary target as
>     demonstrated additionally requires pre-positioned path state such as a
>     symlink with that basename. Subject to the scheduler's filesystem and
>     sandbox access, path separators in the language value can escape the
>     intended banner directory, make the root scheduler open the reachable
>     file, and copy its bytes into a job-sheet spool object that a
>     configured backend can deliver to an attacker-observable endpoint.
>     https://www.cve.org/CVERecord?id=CVE-2026-61702
> 
> - CVE-2026-87875:
>     The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a
>     source-length bound and can read past the end of the source buffer,
>     resulting in a heap out-of-bounds read. This is reachable via SNMP
>     supply-description parsing in backend/snmp-supplies.c with attacker-
>     controlled content.
>     https://www.cve.org/CVERecord?id=CVE-2026-87875
> 
> - CVE-2026-87876:
>     Two case-insensitive comparisons on request-derived usernames outside
>     the main authorization path in CUPS's scheduler (printer ACL
>     validation and private-attribute filtering) could allow bypass of
>     username-based access controls in certain configurations.
>     https://www.cve.org/CVERecord?id=CVE-2026-87876
> 
> - CVE-2026-105326:
>     An argument injection flaw was found in CUPS. When email notification
>     is configured, the CUPS scheduler accepts printer subscription
>     requests that supply a mailto notify-recipient-uri. The mailto
>     notifier passes the recipient address to the configured sendmail
>     program without ensuring it cannot be interpreted as command-line
>     options. A remote attacker who can reach the CUPS service could supply
>     a crafted recipient value starting with "-" to influence sendmail
>     behavior. Successful exploitation depends on the installed mail
>     transfer agent and CUPS network exposure, and may lead to execution of
>     attacker-controlled commands with the privileges of the CUPS service
>     user.
>     https://www.cve.org/CVERecord?id=CVE-2026-105326
> 
> [1] https://github.com/OpenPrinting/cups/pull/1740
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot