Bug 32281 - cups new security issue CVE-2023-32360 and CVE-2023-4504
Summary: cups new security issue CVE-2023-32360 and CVE-2023-4504
Status: ASSIGNED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8TOO
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-13 14:05 CEST by Nicolas Salguero
Modified: 2023-09-27 00:07 CEST (History)
4 users (show)

See Also:
Source RPM: cups-2.4.6-1.mga9.src.rpm
CVE:
Status comment:


Attachments

Description Nicolas Salguero 2023-09-13 14:05:25 CEST
Ubuntu has issued an advisory on September 12:
https://ubuntu.com/security/notices/USN-6361-1

The commit that fixed the issue is:
https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
Nicolas Salguero 2023-09-13 14:05:49 CEST

CC: (none) => nicolas.salguero
Source RPM: (none) => cups-2.3.3op2-1.3.mga8.src.rpm

Comment 1 Lewis Smith 2023-09-13 19:35:27 CEST
Normally done by tv, other packagers are now committing it; so assigning globally, CC'ing Thierry. Note the M8; M9 is at v2.4.6.

Assignee: bugsquad => pkg-bugs
CC: (none) => thierry.vignaud

Comment 2 Nicolas Salguero 2023-09-14 15:32:40 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents. (CVE-2023-32360)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32360
https://ubuntu.com/security/notices/USN-6361-1
========================

Updated packages in core/updates_testing:
========================
cups-2.3.3op2-1.4.mga8
cups-common-2.3.3op2-1.4.mga8
cups-filesystem-2.3.3op2-1.4.mga8
cups-printerapp-2.3.3op2-1.4.mga8
lib(64)cups2-2.3.3op2-1.4.mga8
lib(64)cups2-devel-2.3.3op2-1.4.mga8

from SRPM:
cups-2.3.3op2-1.4.mga8.src.rpm

Status: NEW => ASSIGNED
Assignee: pkg-bugs => nicolas.salguero

Nicolas Salguero 2023-09-18 09:23:14 CEST

Assignee: nicolas.salguero => qa-bugs

Comment 3 Herman Viaene 2023-09-21 11:43:47 CEST
MGA8-64 Xfce on Acer Aspire
No installation issues
Reomved wifi HP Envy 6022 printer in MCC and added it again, and printed test page, all OK.

CC: (none) => herman.viaene

Comment 4 Nicolas Salguero 2023-09-25 10:51:34 CEST
Ubuntu has issued an advisory for CVE-2023-4504 on September 20:
https://ubuntu.com/security/notices/USN-6391-1

The issue is fixed by: https://github.com/OpenPrinting/cups/commit/2431caddb7e6a87f04ac90b5c6366ad268b6ff31

Mageia 8 and 9 are also affected.

Assignee: qa-bugs => pkg-bugs
Status comment: (none) => Fi
Version: 8 => Cauldron
Status: ASSIGNED => NEW
Summary: cups new security issue CVE-2023-32360 => cups new security issue CVE-2023-32360 and CVE-2023-4504
Whiteboard: (none) => MGA9TOO, MGA8TOO

Nicolas Salguero 2023-09-25 10:51:49 CEST

Status comment: Fi => Fixed upstream in 2.4.7

Comment 5 Nicolas Salguero 2023-09-26 10:05:00 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents. (CVE-2023-32360)

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. (CVE-2023-4504)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32360
https://ubuntu.com/security/notices/USN-6361-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4504
https://ubuntu.com/security/notices/USN-6391-1
========================

Updated packages in 9/core/updates_testing:
========================
cups-2.4.6-1.1.mga9
cups-common-2.4.6-1.1.mga9
cups-filesystem-2.4.6-1.1.mga9
cups-printerapp-2.4.6-1.1.mga9
lib(64)cups2-2.4.6-1.1.mga9
lib(64)cups2-devel-2.4.6-1.1.mga9

from SRPM:
cups-2.4.6-1.1.mga9.src.rpm

Updated packages in 8/core/updates_testing:
========================
cups-2.3.3op2-1.5.mga8
cups-common-2.3.3op2-1.5.mga8
cups-filesystem-2.3.3op2-1.5.mga8
cups-printerapp-2.3.3op2-1.5.mga8
lib(64)cups2-2.3.3op2-1.5.mga8
lib(64)cups2-devel-2.3.3op2-1.5.mga8

from SRPM:
cups-2.3.3op2-1.5.mga8.src.rpm

Source RPM: cups-2.3.3op2-1.3.mga8.src.rpm => cups-2.4.6-1.mga9.src.rpm
Version: Cauldron => 9
Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO, MGA8TOO => MGA8TOO
Status comment: Fixed upstream in 2.4.7 => (none)

Comment 6 Morgan Leijström 2023-09-27 00:07:10 CEST
mga9-64 OK here, printing to an Ethernet printer, and to Boomaga.

CC: (none) => fri


Note You need to log in before you can comment on or make changes to this bug.