{"id":"CVE-2017-18190","aliases":["ALPINE-CVE-2017-18190","DEBIAN-CVE-2017-18190","DLA-1288-1","DLA-1412-1","EUVD-2017-9325","GHSA-vfqc-qhm9-65mm","MGASA-2018-0147","RHSA-2020:3864","SUSE-SU-2018:0604-1","UBUNTU-CVE-2017-18190","USN-3577-1"],"status":"published","title":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2...","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02923,"percentile":0.87138,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2018-02-16T00:00:00Z","modified":"2026-10-20T13:37:09Z","fixes":[{"ecosystem":"Alpine:v3.5","package":"cups","fixed_in":["2.2.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.2.3-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"cups","fixed_in":["1.5.3-5+deb7u7"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"cups","fixed_in":["2.0.4-1.4.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cups","fixed_in":["1.7.5-20.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"cups","fixed_in":["1.7.2-0ubuntu1.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"cups","fixed_in":["2.1.3-4ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5+deb7u7"}]}],"versions":["1.5.3-5","1.5.3-5+deb7u1","1.5.3-5+deb7u2","1.5.3-5+deb7u3","1.5.3-5+deb7u4","1.5.3-5+deb7u5","1.5.3-5+deb7u6"]},{"source":"osv","ecosystem":"Debian:8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-11+deb8u3"}]}],"versions":["1.7.5-11","1.7.5-11+deb8u1","1.7.5-11+deb8u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.4.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-51.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-0ubuntu1.9"}]}],"versions":["1.7.0~rc1-0ubuntu5","1.7.0-0ubuntu2","1.7.0-0ubuntu3","1.7.0-1","1.7.0-2","1.7.1-1","1.7.1-2","1.7.1-2git1","1.7.1-3","1.7.1-4","1.7.1-4ubuntu1","1.7.1-5ubuntu1","1.7.1-5ubuntu3","1.7.1-5ubuntu4","1.7.1-5ubuntu5","1.7.1-5ubuntu6","1.7.1-5ubuntu7","1.7.1-5ubuntu8","1.7.1-5ubuntu9","1.7.1-5ubuntu10","1.7.2-0ubuntu1","1.7.2-0ubuntu1.1","1.7.2-0ubuntu1.2","1.7.2-0ubuntu1.4","1.7.2-0ubuntu1.5","1.7.2-0ubuntu1.6","1.7.2-0ubuntu1.7","1.7.2-0ubuntu1.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.4"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-0ubuntu1.9"}]}],"versions":["1.7.0~rc1-0ubuntu5","1.7.0-0ubuntu2","1.7.0-0ubuntu3","1.7.0-1","1.7.0-2","1.7.1-1","1.7.1-2","1.7.1-2git1","1.7.1-3","1.7.1-4","1.7.1-4ubuntu1","1.7.1-5ubuntu1","1.7.1-5ubuntu3","1.7.1-5ubuntu4","1.7.1-5ubuntu5","1.7.1-5ubuntu6","1.7.1-5ubuntu7","1.7.1-5ubuntu8","1.7.1-5ubuntu9","1.7.1-5ubuntu10","1.7.2-0ubuntu1","1.7.2-0ubuntu1.1","1.7.2-0ubuntu1.2","1.7.2-0ubuntu1.4","1.7.2-0ubuntu1.5","1.7.2-0ubuntu1.6","1.7.2-0ubuntu1.7","1.7.2-0ubuntu1.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.4"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3"]}],"products":[{"vendor":"apple","product":"cups"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://usn.ubuntu.com/3577-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1048","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18190","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vfqc-qhm9-65mm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-18190","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18190","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22649","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3577-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3864","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1546395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1715907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738497","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3864.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18190","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-8675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8675","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-8696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8696","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1081557","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18190","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-18190","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3577-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:00:00Z","modified":"2024-08-05T21:13:49.106Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9325","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:00:00Z","modified":"2024-08-05T21:13:49Z","updated_at":"2026-11-03T02:23:07.6199Z"}],"ghsa":[{"id":"GHSA-vfqc-qhm9-65mm","title":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2...","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2022-05-13T01:44:36Z","modified":"2023-02-02T05:01:07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:51:07.034252Z"}],"nvd":[{"id":"CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:29:00.217Z","modified":"2026-06-17T01:12:21.61Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"ALPINE-CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:29:00.217Z","modified":"2026-06-15T18:24:58.23087134Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:29:00.217Z","modified":"2026-10-20T13:37:09.097141943Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T17:29:00.217Z","modified":"2026-09-01T20:03:46.923627779Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"RHSA-2020:3864","title":"Red Hat Security Advisory: cups security and bug fix update","status":"published","published":"2024-09-16T03:30:43Z","modified":"2026-06-26T12:22:16.188398364Z","cvss":[{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2017-18190","description":"A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).","status":"published","published":"2018-02-16T00:00:00Z","modified":"2026-04-22T11:21:35.003152Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1288-1","title":"cups - security update","status":"published","published":"2018-02-22T00:00:00Z","modified":"2026-03-09T01:01:40.282776Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1412-1","title":"cups - security update","status":"published","published":"2018-07-03T00:00:00Z","modified":"2026-03-09T01:01:04.830013Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2018-0147","title":"Updated cups packages fix security vulnerability","description":"Updated cups packages fix security vulnerability:\n\nJann Horn discovered that CUPS permitted HTTP requests with the Host header set\nto \"localhost.localdomain\" from the loopback interface. If a user were tricked\nin to opening a specially crafted website in their web browser, an attacker\ncould potentially exploit this to obtain sensitive information or control\nprinters, via a DNS rebinding attack (CVE-2017-18190).\n","status":"published","published":"2018-02-26T23:40:56Z","modified":"2026-04-16T04:41:20.998788371Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:0604-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2017-18190: Removed localhost.localdomain from list\n  of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP\n  command execution in conjunction with DNS rebinding.\n  (bsc#1081557)\n","status":"published","published":"2018-03-05T09:43:11Z","modified":"2025-05-02T04:06:39.486852Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3577-1","title":"cups vulnerability","description":"Jann Horn discovered that CUPS permitted HTTP requests with the Host\nheader set to \"localhost.localdomain\" from the loopback interface. If a\nuser were tricked in to opening a specially crafted website in their web\nbrowser, an attacker could potentially exploit this to obtain sensitive\ninformation or control printers, via a DNS rebinding attack.\n(CVE-2017-18190)\n","status":"published","published":"2018-02-21T00:05:33Z","modified":"2026-04-22T09:44:56.303528Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}