CUPS 2.4.11 is released!

CUPS 2.4.11 is released!

[Zdenek Dohnal]

Hi all,

CUPS 2.4.11 brings several bug fixes regarding IPP response validation, 
processing PPD values, Web UI support (checkbox support, modifying 
printers) and others fixes.

Detailed list of changes is available in CHANGES.md

Enjoy!

-- 
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC

Re: CUPS 2.4.11 is released!

[Till Kamppeter]

Zdenek,

thanks for the quick release, but the CHANGES.md does not mention the 
CVE-related fixes contained in it.

    Till

On 9/30/24 14:25, Zdenek Dohnal wrote:
> Hi all,
> 
> CUPS 2.4.11 brings several bug fixes regarding IPP response validation, 
> processing PPD values, Web UI support (checkbox support, modifying printers) and 
> others fixes.
> 
> Detailed list of changes is available in CHANGES.md
> 
> Enjoy!
> 

Re: CUPS 2.4.11 is released!

[Mike Sweet]

Till,

We didn’t have any CVEs filed against CUPS.

Sent from my iPhone

> On Sep 30, 2024, at 10:43 AM, Till Kamppeter <till.kamppeter@gmail.com> wrote:
> 
> Zdenek,
> 
> thanks for the quick release, but the CHANGES.md does not mention the CVE-related fixes contained in it.
> 
>   Till
> 
>> On 9/30/24 14:25, Zdenek Dohnal wrote:
>> Hi all,
>> CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes.
>> Detailed list of changes is available in CHANGES.md
>> Enjoy!
> 
> 

Re: CUPS 2.4.11 is released!

[Johannes Meixner]

Hello,

On 2024-09-30 16:42, Till Kamppeter wrote:
> thanks for the quick release, but the CHANGES.md
> does not mention the CVE-related fixes contained in it.

> On 9/30/24 14:25, Zdenek Dohnal wrote:
>> CUPS 2.4.11 brings several bug fixes
>> regarding IPP response validation, processing PPD values,
>> Web UI support (checkbox support, modifying printers)
>> and others fixes.

I was also wondering about CVE-related fixes.
As far as I understand it from the GitHub upstream commits
CUPS 2.4.11 contains (only) those commits regarding
IPP response validation and processing PPD values

"Quote PPD localized strings"
https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd

plus the cleanup to "Fix warnings for unused vars"
https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b

which are somewhat related to those CVEs
by avoiding sililar further issues as in those CVEs
but are not the actual fixes for explicitly those CVEs.


Kind Regards
Johannes Meixner
-- 
SUSE Software Solutions Germany GmbH
Frankenstr. 146 - 90461 Nuernberg - Germany
(HRB 36809, AG Nuernberg) GF: Ivo Totev

Re: CUPS 2.4.11 is released!

[Zdenek Dohnal]

Hi all,

since the fixes in CUPS were not handled as CVEs, I've stayed with the 
current handling.

In any way, it is always advised to upgrade to the latest packages if it 
is possible.

If anyone is looking for CVE-related fixes, those are the commits:

https://github.com/OpenPrinting/cups/commit/9939a70b750edd9d05270060cc5cf62ca98cfbe5

https://github.com/OpenPrinting/cups/commit/04bb2af4521b56c1699a2c2431c56c05a7102e69

https://github.com/OpenPrinting/cups/commit/e0630cd18f76340d302000f2bf6516e99602b844

https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd

https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b


Zdenek

On 9/30/24 16:55, Johannes Meixner wrote:
>
> Hello,
>
> On 2024-09-30 16:42, Till Kamppeter wrote:
>> thanks for the quick release, but the CHANGES.md
>> does not mention the CVE-related fixes contained in it.
>
>> On 9/30/24 14:25, Zdenek Dohnal wrote:
>>> CUPS 2.4.11 brings several bug fixes
>>> regarding IPP response validation, processing PPD values,
>>> Web UI support (checkbox support, modifying printers)
>>> and others fixes.
>
> I was also wondering about CVE-related fixes.
> As far as I understand it from the GitHub upstream commits
> CUPS 2.4.11 contains (only) those commits regarding
> IPP response validation and processing PPD values
>
> "Quote PPD localized strings"
> https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd 
>
>
> plus the cleanup to "Fix warnings for unused vars"
> https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b 
>
>
> which are somewhat related to those CVEs
> by avoiding sililar further issues as in those CVEs
> but are not the actual fixes for explicitly those CVEs.
>
>
> Kind Regards
> Johannes Meixner

-- 
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC