CVE-2023-32360

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Information leak through Cups-Get-Document operation (CVE-2023-32360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Information leak through Cups-Get-Document operation (CVE-2023-32360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: An unauthenticated user may be able to access recently printed documents. The config file /etc/cups/cupsd.conf should be edited manually in case the cups has been already installed in the system: the <Limit Send-Document> and <Limit CUPS-Get-Document> sections should be changed according to the patch
  • debian/patches/CVE-2023-32360.patch: Require authentication for CUPS-Get-Document.
  • CVE-2023-32360

• SECURITY UPDATE: An unauthenticated user may be able to access recently printed documents. The config file /etc/cups/cupsd.conf should be edited manually in case the cups has been already installed in the system: the <Limit Send-Document> and <Limit CUPS-Get-Document> sections should be changed according to the patch.
  • debian/patches/CVE-2023-32360.patch: Require authentication for CUPS-Get-Document.
  • CVE-2023-32360

• CVE-2023-32360: require authentication for CUPS-Get-Document.
• CVE-2023-32324: fix _cups_strlcpy() to exit immediately if a length of the source string is zero

• CVE-2023-32360: require authentication for CUPS-Get-Document.
• CVE-2023-32324: fix _cups_strlcpy() to exit immediately if a length of the source string is zero

The updated packages fix security vulnerabilities:

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents. (CVE-2023-32360)

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. (CVE-2023-4504)

These are all security issues fixed in the cups-2.4.2-7.1 package on the GA media of openSUSE Tumbleweed.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Information leak through Cups-Get-Document operation (CVE-2023-32360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Information leak through Cups-Get-Document operation (CVE-2023-32360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-34241: Fixed a use-after-free problem in cupsdAcceptClient() (bsc#1212230).
• CVE-2023-32360: Fixed information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204).
• CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for cups fixes the following issues:

• Version upgrade to 2.4.11: See https://github.com/openprinting/cups/releases CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes. Detailed list (from CHANGES.md):

  • Updated the maximum file descriptor limit for cupsd to 64k-1 (Issue #989)
  • Fixed lpoptions -d with a discovered but not added printer (Issue #833)
  • Fixed incorrect error message for HTTP/IPP errors (Issue #893)
  • Fixed JobPrivateAccess and SubscriptionPrivateAccess support for "all" (Issue #990)
  • Fixed issues with cupsGetDestMediaByXxx (Issue #993)
  • Fixed adding and modifying of printers via the web interface (Issue #998)
  • Fixed HTTP PeerCred authentication for domain users (Issue #1001)
  • Fixed checkbox support (Issue #1008)
  • Fixed printer state notifications (Issue #1013)
  • Fixed IPP Everywhere printer setup (Issue #1033) Issues are those at https://github.com/OpenPrinting/cups/issues In particular CUPS 2.4.11 contains those commit regarding IPP response validation and processing PPD values:
  • "Quote PPD localized strings" https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd plus a cleanup to "Fix warnings for unused vars" https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b

• Version upgrade to 2.4.10: See https://github.com/openprinting/cups/releases CUPS 2.4.10 brings two fixes:

  • Fixed error handling when reading a mixed 1setOf attribute.
  • Fixed scheduler start if there is only domain socket to listen on (Issue #985) which is fix for regression after fix for CVE-2024-35235 in scenarios where is no other listeners in cupsd.conf than domain socket created on demand by systemd, launchd or upstart. Issues are those at https://github.com/OpenPrinting/cups/issues

• Version upgrade to 2.4.9: See https://github.com/openprinting/cups/releases CUPS 2.4.9 brings security fix for CVE-2024-35235 and several bug fixes regarding CUPS Web User Interface, PPD generation and HTTP protocol implementation. Detailed list (from CHANGES.md):

  • Fixed domain socket handling (CVE-2024-35235)
  • Fixed creating of cupsUrfSupported PPD keyword (Issue #952)
  • Fixed searching for destinations in web ui (Issue #954)
  • Fixed TLS negotiation using OpenSSL with servers that require the TLS SNI extension.
  • Really raised cups_enum_dests() timeout for listing available IPP printers (Issue #751)...
  • Fixed Host header regression (Issue #967)
  • Fixed DNS-SD lookups of local services with Avahi (Issue #970)
  • Fixed listing jobs in destinations in web ui. (Apple issue #6204)
  • Fixed showing search query in web ui help page. (Issue #977) Issues are those at https://github.com/OpenPrinting/cups/issues Apple issues are those at https://github.com/apple/cups/issues

• Update to version 2.4.8: See https://github.com/openprinting/cups/releases CUPS 2.4.8 brings many bug fixes which aggregated over the last half a year. It brings the important fix for race conditions and errors which can happen when installing permanent IPP Everywhere printer, support for PAM modules password-auth and system-auth and new option for lpstat which can show only the successful jobs. Detailed list (from CHANGES.md):

  • Added warning if the device has to be asked for 'all,media-col-database' separately (Issue #829)
  • Added new value for 'lpstat' option '-W' - successfull - for getting successfully printed jobs (Issue #830)
  • Added support for PAM modules password-auth and system-auth (Issue #892)
  • Updated IPP Everywhere printer creation error reporting (Issue #347)
  • Updated and documented the MIME typing buffering limit (Issue #925)
  • Raised 'cups_enum_dests()' timeout for listing …

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents.

USN-6361-1 fixed a vulnerability in CUPS. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that CUPS incorrectly authenticated certain remote requests. A remote attacker could possibly use this issue to obtain recently printed documents.