[Buildroot] [PATCH 1/1] package/cups: security bump to v2.4.20

* [Buildroot] [PATCH 1/1] package/cups: security bump to v2.4.20
@ 2026-10-25 17:48 Thomas Perale via buildroot
  2026-10-25 20:25 ` Thomas Petazzoni via buildroot
  0 siblings, 1 reply; 2+ messages in thread
From: Thomas Perale via buildroot @ 2026-10-25 17:48 UTC (permalink / raw)
  To: buildroot; +Cc: Angelo Compagnucci, Olivier Schonken

See the release note:

- https://github.com/OpenPrinting/cups/releases/tag/v2.4.20

The additional patch is required to fix the build with the option
`--with-dnssd=no`. This build error can be triggered by not enabling the
package `BR2_PACKAGE_AVAHI_LIBAVAHI_CLIENT` [1].

Fixes the following vulnerabilities:

- CVE-2026-55453:
    OpenPrinting CUPS is an open source printing system for Linux and
    other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c
    quote_string() function preserves carriage-return and line-feed
    characters in a remote printer-controlled marker-message before
    report_attr() writes the value to the scheduler status stream. The
    scheduler can parse an injected newline as a separate PPD: control
    line and persist an attacker-selected PPD keyword. The reporter
    demonstrated that a later print job on a Foomatic-backed queue could
    consume an injected FoomaticRIPCommandLine value and execute in the
    filter context as lp.
    https://www.cve.org/CVERecord?id=CVE-2026-55453

- CVE-2026-55467:
    OpenPrinting CUPS is an open source printing system for Linux and
    other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob
    option-string builder in scheduler/job.c maps attacker-controlled
    destination-uri and pre-dial-string values from a configured fax queue
    to the phone and faxPrefix options. Unlike ordinary IPP job
    attributes, these mapped fax values bypass the control-character
    sanitizer and are copied directly into the filter options argument. A
    user permitted to submit a job can therefore inject control characters
    into the downstream option stream. The reporter states that a
    downstream fax filter passing these values to a shell or modem command
    could execute code as lp, while the maintainer states that CUPS has no
    confidentiality or integrity impact because the only known code-
    executing filter is optional Foomatic and addressed separately,
    leaving possible disruption of the affected queue.
    https://www.cve.org/CVERecord?id=CVE-2026-55467

- CVE-2026-55480:
    OpenPrinting CUPS is an open source printing system for Linux and
    other Unix-like operating systems. Prior to 2.4.20, copy_model() in
    scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd
    path in an lp-group-writable directory and opens it as root without
    O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able
    to write that directory to predict the connection-derived name and
    plant a symlink before the root open, while a privileged add-printer
    or modify-printer operation using a model PPD triggers copy_model().
    The reporter treats an existing lp foothold and the privileged
    operation as distinct prerequisites, while the maintainer assesses
    high privileges because installing the relevant filter or
    administering the printer requires root or print-administrator access.
    If the race succeeds, the root scheduler follows the symlink and
    truncates or overwrites a root-writable target with generated PPD
    data, compromising file integrity or availability.
    https://www.cve.org/CVERecord?id=CVE-2026-55480

- CVE-2026-61702:
    OpenPrinting CUPS is an open source printing system for Linux and
    other Unix-like operating systems. Prior to 2.4.20, copy_banner() in
    scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-
    language value as a directory component beneath DataDir/banners when
    processing a job-sheets banner. The job-sheets value must first match
    a registered banner basename, and the traversed path must contain a
    matching reachable basename; selecting an arbitrary target as
    demonstrated additionally requires pre-positioned path state such as a
    symlink with that basename. Subject to the scheduler's filesystem and
    sandbox access, path separators in the language value can escape the
    intended banner directory, make the root scheduler open the reachable
    file, and copy its bytes into a job-sheet spool object that a
    configured backend can deliver to an attacker-observable endpoint.
    https://www.cve.org/CVERecord?id=CVE-2026-61702

- CVE-2026-87875:
    The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a
    source-length bound and can read past the end of the source buffer,
    resulting in a heap out-of-bounds read. This is reachable via SNMP
    supply-description parsing in backend/snmp-supplies.c with attacker-
    controlled content.
    https://www.cve.org/CVERecord?id=CVE-2026-87875

- CVE-2026-87876:
    Two case-insensitive comparisons on request-derived usernames outside
    the main authorization path in CUPS's scheduler (printer ACL
    validation and private-attribute filtering) could allow bypass of
    username-based access controls in certain configurations.
    https://www.cve.org/CVERecord?id=CVE-2026-87876

- CVE-2026-105326:
    An argument injection flaw was found in CUPS. When email notification
    is configured, the CUPS scheduler accepts printer subscription
    requests that supply a mailto notify-recipient-uri. The mailto
    notifier passes the recipient address to the configured sendmail
    program without ensuring it cannot be interpreted as command-line
    options. A remote attacker who can reach the CUPS service could supply
    a crafted recipient value starting with "-" to influence sendmail
    behavior. Successful exploitation depends on the installed mail
    transfer agent and CUPS network exposure, and may lead to execution of
    attacker-controlled commands with the privileges of the CUPS service
    user.
    https://www.cve.org/CVERecord?id=CVE-2026-105326

[1] https://github.com/OpenPrinting/cups/pull/1740

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 ...stination-enumeration-without-DNS-SD.patch | 29 +++++++++++++++++++
 package/cups/cups.hash                        |  4 +--
 package/cups/cups.mk                          |  2 +-
 3 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 package/cups/0005-Fix-destination-enumeration-without-DNS-SD.patch

diff --git a/package/cups/0005-Fix-destination-enumeration-without-DNS-SD.patch b/package/cups/0005-Fix-destination-enumeration-without-DNS-SD.patch
new file mode 100644
index 0000000000..b342427023
--- /dev/null
+++ b/package/cups/0005-Fix-destination-enumeration-without-DNS-SD.patch
@@ -0,0 +1,29 @@
+From 23a183b63a4c94ae7cd0f36c63ee7eb905be60fd Mon Sep 17 00:00:00 2001
+From: Rui Chen <rui@chenrui.dev>
+Date: Mon, 5 Oct 2026 22:55:47 -0400
+Subject: [PATCH] Fix destination enumeration without DNS-SD
+
+Add the local destination fields used by cups_enum_dests to the non-DNS-SD callback data structure.
+
+Fixes #1739
+
+Signed-off-by: Rui Chen <rui@chenrui.dev>
+Upstream: https://github.com/OpenPrinting/cups/commit/a197d30e27b5dd4d8c41d7a8ab136727290ed7de
+Signed-off-by: Thoams Perale <thomas.perale@mind.be>
+---
+ cups/dest.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/cups/dest.c b/cups/dest.c
+index dac26f119e..676470e70c 100644
+--- a/cups/dest.c
++++ b/cups/dest.c
+@@ -125,6 +125,8 @@ typedef struct _cups_getdata_s
+ {
+   int		num_dests;		/* Number of destinations */
+   cups_dest_t	*dests;			/* Destinations */
++  int		num_local;		/* Number of local cupsd queues */
++  cups_dest_t	*local_dests;		/* Local cupsd queues */
+   char		def_name[1024],		/* Default printer name, if any */
+ 		*def_instance;		/* Default printer instance, if any */
+ } _cups_getdata_t;
diff --git a/package/cups/cups.hash b/package/cups/cups.hash
index 7cb25fc4dd..eb029e8683 100644
--- a/package/cups/cups.hash
+++ b/package/cups/cups.hash
@@ -1,5 +1,5 @@
-# From https://github.com/OpenPrinting/cups/releases/tag/v2.4.19
-sha256  820984b12a67f98705785aae2dd1347fe0ac097828001d4583ff64574aed6389  cups-2.4.19-source.tar.gz
+# From https://github.com/OpenPrinting/cups/releases/tag/v2.4.20
+sha256  ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff  cups-2.4.20-source.tar.gz
 # Locally calculated:
 sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
 sha256  977206f041b9a6f47ac00531e1242c0fab7063da71178f8d868b167b70866b6d  NOTICE
diff --git a/package/cups/cups.mk b/package/cups/cups.mk
index 3e85a2eecf..2fbf65e58e 100644
--- a/package/cups/cups.mk
+++ b/package/cups/cups.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CUPS_VERSION = 2.4.19
+CUPS_VERSION = 2.4.20
 CUPS_SOURCE = cups-$(CUPS_VERSION)-source.tar.gz
 CUPS_SITE = https://github.com/OpenPrinting/cups/releases/download/v$(CUPS_VERSION)
 CUPS_LICENSE = Apache-2.0 with GPL-2.0/LGPL-2.0 exception
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread