CVE-2025-58060

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

'Hi all,\n\nthere is important security vulnerability in CUPS:\n\n\n\xa0\xa0 Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details', 'PoC\n\n- Configure CUPS with |DefaultAuthType Negotiate|.\n- Start CUPS', '- cat /etc/cups/cupsd.conf\nhaha\n\n\n\xa0\xa0\xa0\xa0 Impact', 'Patch', 'Have a nice day,\n\n\nZdenek Dohnal\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'

'Hi all!', 'Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details\n\nThe combination of:', 'Is shown in two places in OpenPrinting:\n\n|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c |', 'PoC', 'Impact', 'Metrics:\n\n\n\xa0\xa0\xa0\xa0\xa0\xa0 CVSS v3 base metrics\n\nAttack vector Adjacent\nAttack complexity Low\nPrivileges required None\nUser interaction None\nScope Unchanged\nConfidentiality None\nIntegrity None\nAvailability High\n\nCredit -', 'Patch', 'Have a nice day!\n\n\nZdenek\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)
• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)
• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

The Common UNIX Printing System (CUPS) provides a portable printing layer for
Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS

(CVE-2025-58364)

• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for
Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)
• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

The Common UNIX Printing System (CUPS) provides a portable printing layer for
Linux, UNIX, and similar operating systems.

Security Fix(es):

• cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

• CVE-2025-58060: fix authentication bypass with AuthType Negotiate

• SECURITY UPDATE: authentication bypass vulnerability
  • debian/patches/CVE-2025-58060.patch: block authentication using alternate method in scheduler/auth.c
  • CVE-2025-58060

• SECURITY UPDATE: authentication bypass vulnerability
  • debian/patches/CVE-2025-58060.patch: block authentication using alternate method in scheduler/auth.c
  • CVE-2025-58060

• CVE-2023-4504: validate length of attacker-crafted PPD PostScript documents to prevent heap-based buffer overflow and possible code execution
• CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic.

• CVE-2023-4504: validate length of attacker-crafted PPD PostScript documents to prevent heap-based buffer overflow and possible code execution
• CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic.

• CVE-2025-58060: fix authentication bypass issue caused by not checking password when AuthType is not Basic.

• CVE-2025-58060: fix authentication bypass by checking password when AuthType is set to anything but Basic.

• CVE-2025-58060: fix authentication bypass by checking password when AuthType is set to anything but Basic.

• CVE-2025-58060: fix authentication bypass by checking password when AuthType is set to anything but Basic.

• CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType

• CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType

• SECURITY UPDATE: authentication bypass via alternate auth method
  • debian/patches/CVE-2025-58060.patch: only validate Basic credentials when the resource requires Basic auth, and only process Negotiate when it requires Kerberos, in scheduler/auth.c cupsdAuthorize(); backport of upstream commit 595d691075b1d396d2edfaa0a8fd0873a0a1f221
  • CVE-2025-58060

• SECURITY UPDATE: fix authentication bypass in cupsd caused by dispatching on the client-supplied Authorization scheme without checking it against the configured AuthType.
  • debian/patches/CVE-2025-58060.patch: reject "Authorization: Basic" unless the effective AuthType is CUPSD_AUTH_BASIC and "Authorization: Negotiate" unless it is CUPSD_AUTH_NEGOTIATE in cupsdAuthorize() in scheduler/auth.c.
  • CVE-2025-58060.
• Fix cupsd failing to start with "cupsdDoSelect() failed - Bad address!" on hosts whose RLIMIT_NOFILE hard limit is very large but not RLIM_INFINITY, where the epoll event array allocation fails.
  • debian/patches/maxfds-limit.patch: cap MaxFDs at 65535 in scheduler/main.c, backported from upstream Issue #989.

• rebase to 1.6.3-52.0.1.el7_9
• CVE-2025-58060: take the vendor's fix, keep logging rejected alternate-method authentication

• rebase to 1.6.3-52.0.1.el7_9
• CVE-2025-58060: take the vendor's fix, keep logging rejected alternate-method authentication

• rebase to 1.6.3-52.0.1.el7_9
• CVE-2025-58060: take the vendor's fix, keep logging rejected alternate-method authentication

cups has Authentication bypass with AuthType Negotiate. (CVE-2025-58060) cups: Remote DoS via null dereference. (CVE-2025-58364)

These are all security issues fixed in the cups-2.4.14-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cups fixes the following issues:

Update to version 2.4.16.

Security issues fixed:

• CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).
• CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).
• CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference (bsc#1249128).
• CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).

Other updates and bugfixes:

• Version upgrade to 2.4.16:

  • 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences, potentially reading past the end of the source string (Issue #1438)
  • The web interface did not support domain usernames fully (Issue #1441)
  • Fixed an infinite loop issue in the GTK+ print dialog (Issue #1439 boo#1254353)
  • Fixed stopping scheduler on unknown directive in configuration (Issue #1443)
  • Fixed packages for Immutable Mode (jsc#PED-14775 from epic jsc#PED-14688)

• Version upgrade to 2.4.15:

  • Fixed potential crash in 'cups-driverd' when there are duplicate PPDs (Issue #1355)
  • Fixed error recovery when scanning for PPDs in 'cups-driverd' (Issue #1416)

• Version upgrade to 2.4.14.

• Version upgrade to 2.4.13:

  • Added 'print-as-raster' printer and job attributes for forcing rasterization (Issue #1282)
  • Updated documentation (Issue #1086)
  • Updated IPP backend to try a sanitized user name if the printer/server does not like the value (Issue #1145)
  • Updated the scheduler to send the "printer-added" or "printer-modified" events whenever an IPP Everywhere PPD is installed (Issue #1244)
  • Updated the scheduler to send the "printer-modified" event whenever the system default printer is changed (Issue #1246)
  • Fixed a memory leak in 'httpClose' (Issue #1223)
  • Fixed missing commas in 'ippCreateRequestedArray' (Issue #1234)
  • Fixed subscription issues in the scheduler and D-Bus notifier (Issue #1235)
  • Fixed media-default reporting for custom sizes (Issue #1238)
  • Fixed support for IPP/PPD options with periods or underscores (Issue #1249)
  • Fixed parsing of real numbers in PPD compiler source files (Issue #1263)
  • Fixed scheduler freezing with zombie clients (Issue #1264)
  • Fixed support for the server name in the ErrorLog filename (Issue #1277)
  • Fixed job cleanup after daemon restart (Issue #1315)
  • Fixed handling of buggy DYMO USB printer serial numbers (Issue #1338)
  • Fixed unreachable block in IPP backend (Issue #1351)
  • Fixed memory leak in _cupsConvertOptions (Issue #1354)

• Version upgrade to 2.4.12:

  • GnuTLS follows system crypto policies now (Issue #1105)
  • Added NoSystem SSLOptions value (Issue #1130)
  • Now we raise alert for certificate issues (Issue #1194)
  • Added Kyocera USB quirk (Issue #1198)
  • The scheduler now logs a job's debugging history if the backend fails (Issue #1205)
  • Fixed a potential timing issue with cupsEnumDests (Issue #1084)
  • Fixed a potential "lost PPD" condition in the scheduler (Issue #1109)
  • Fixed a compressed file error handling bug (Issue #1070)
  • Fixed a bug in the make-and-model whitespace trimming code (Issue #1096)
  • Fixed a removal of IPP Everywhere permanent queue if installation failed (Issue #1102)
  • Fixed ServerToken None in scheduler (Issue #1111)
  • Fixed invalid IPP keyword values created from PPD option names (Issue #1118)
  • Fixed handling of "media" and "PageSize" in the same print request (Issue #1125)
  • Fixed client raster printing from macOS (Issue #1143)
  • Fixed the default User-Agent string.
  • Fixed a recursion issue in ippReadIO.
  • Fixed handling incorrect radix in scan_ps() (Issue #1188)
  • Fixed validation of dateTime values with time zones more than UTC+11 (Issue #1201)
  • Fixed attributes returned by the Create-Xxx-Subscriptions requests (Issue…

This update for cups fixes the following issues:

• CVE-2025-58060: no password check when AuthType is set to anything but Basic and a request is made with an Authorization: Basic header (bsc#1249049).
• CVE-2025-58364: unsafe deserialization and validation of printer attributes leads to NULL pointer dereference (bsc#1249128).

This update for cups fixes the following issues:

• CVE-2024-47175: no validation of IPP attributes in ppdCreatePPDFromIPP2 when writing to a temporary PPD file allows for the injection of attacker-controlled data to the resulting PPD (bsc#1230932).
• CVE-2025-58060: no password check when AuthType is set to anything but Basic and a request is made with an Authorization: Basic header (bsc#1249049).
• CVE-2025-58364: unsafe deserialization and validation of printer attributes leads to NULL pointer dereference (bsc#1249128).

This update for cups fixes the following issues:

Update to version 2.4.16.

Security issues fixed:

• CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).
• CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).
• CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference (bsc#1249128).
• CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).

Other updates and bugfixes:

• Version upgrade to 2.4.16:

  • 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences, potentially reading past the end of the source string (Issue #1438)
  • The web interface did not support domain usernames fully (Issue #1441)
  • Fixed an infinite loop issue in the GTK+ print dialog (Issue #1439 boo#1254353)
  • Fixed stopping scheduler on unknown directive in configuration (Issue #1443)
  • Fixed packages for Immutable Mode (jsc#PED-14775 from epic jsc#PED-14688)

• Version upgrade to 2.4.15:

  • Fixed potential crash in 'cups-driverd' when there are duplicate PPDs (Issue #1355)
  • Fixed error recovery when scanning for PPDs in 'cups-driverd' (Issue #1416)

• Version upgrade to 2.4.14.

• Version upgrade to 2.4.13:

  • Added 'print-as-raster' printer and job attributes for forcing rasterization (Issue #1282)
  • Updated documentation (Issue #1086)
  • Updated IPP backend to try a sanitized user name if the printer/server does not like the value (Issue #1145)
  • Updated the scheduler to send the "printer-added" or "printer-modified" events whenever an IPP Everywhere PPD is installed (Issue #1244)
  • Updated the scheduler to send the "printer-modified" event whenever the system default printer is changed (Issue #1246)
  • Fixed a memory leak in 'httpClose' (Issue #1223)
  • Fixed missing commas in 'ippCreateRequestedArray' (Issue #1234)
  • Fixed subscription issues in the scheduler and D-Bus notifier (Issue #1235)
  • Fixed media-default reporting for custom sizes (Issue #1238)
  • Fixed support for IPP/PPD options with periods or underscores (Issue #1249)
  • Fixed parsing of real numbers in PPD compiler source files (Issue #1263)
  • Fixed scheduler freezing with zombie clients (Issue #1264)
  • Fixed support for the server name in the ErrorLog filename (Issue #1277)
  • Fixed job cleanup after daemon restart (Issue #1315)
  • Fixed handling of buggy DYMO USB printer serial numbers (Issue #1338)
  • Fixed unreachable block in IPP backend (Issue #1351)
  • Fixed memory leak in _cupsConvertOptions (Issue #1354)

• Version upgrade to 2.4.12:

  • GnuTLS follows system crypto policies now (Issue #1105)
  • Added NoSystem SSLOptions value (Issue #1130)
  • Now we raise alert for certificate issues (Issue #1194)
  • Added Kyocera USB quirk (Issue #1198)
  • The scheduler now logs a job's debugging history if the backend fails (Issue #1205)
  • Fixed a potential timing issue with cupsEnumDests (Issue #1084)
  • Fixed a potential "lost PPD" condition in the scheduler (Issue #1109)
  • Fixed a compressed file error handling bug (Issue #1070)
  • Fixed a bug in the make-and-model whitespace trimming code (Issue #1096)
  • Fixed a removal of IPP Everywhere permanent queue if installation failed (Issue #1102)
  • Fixed ServerToken None in scheduler (Issue #1111)
  • Fixed invalid IPP keyword values created from PPD option names (Issue #1118)
  • Fixed handling of "media" and "PageSize" in the same print request (Issue #1125)
  • Fixed client raster printing from macOS (Issue #1143)
  • Fixed the default User-Agent string.
  • Fixed a recursion issue in ippReadIO.
  • Fixed handling incorrect radix in scan_ps() (Issue #1188)
  • Fixed validation of dateTime values with time zones more than UTC+11 (Issue #1201)
  • Fixed attributes returned by the Create-Xxx-Subscriptions requests (Issue…