cups-2.4.17

[Douglas R. Reno]

From oss-security:

https://heyitsas.im/posts/cups/ discloses:

    1. CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests
            reach lp code execution over the network

    2. CVE-2026-34990: Local print admin token disclosure using temporary printers

    At a high level, in the first vulnerability, the attacker:

     1. Submits a malicious print job to a shared PostScript queue,
     2. Gets CUPS to treat attacker-controlled text as a trusted queue config by
        abusing a parsing bug, and
     3. Gets code execution as the CUPS service user, lp (vim in the PoC)

    And in the second vulnerability, the attacker:

     1. Uses any* unprivileged local user to set up a localhost listener,
     2. Creates a local printer object in CUPS, pointing it at the listener above,
     3. Gets CUPS to authenticate to it and captures the auth token,
     4. Creates another queue pointing at file:///... for the target rootful write,
     5. Uses the token to race against CUPS validation logic’s cleanup of the
        dangerous queue, and
     6. Writes what they want into the target file:///... (/etc/sudoers.d/... in
        the PoC)

    * any unprivileged local user that can bind on some TCP port and reach the
      local CUPS listener.

    Are you affected? + Mitigation

    The unauth’d RCE as lp (CVE-2026-34980) requires the CUPS server to be
    reachable over the network and expose a shared PostScript queue (these are
    legacy, but still used). This would be a deliberate config choice – realistic
    for, say, networked printing servers in your corporate environment, but not
    for your desktop (unless you for some reason set it up to be a remote printing
    server).

    The LPE to root file (over)write (CVE-2026-34990), on the other hand, works
    on the stock CUPS config.

    For both issues, the harm can be limited by a security module that confines
    CUPS (e.g., SELinux, AppArmor, etc.). So, if you run CUPS under a sane
    security policy (default on some distributions), the impact of both

    vulnerabilities is much less severe – e.g., no rootful file writes outside the paths CUPS is constrained to touch.


    As of 4/5/2026, there are public commits with fixes to both issues but no
    fixed release (latest being 2.4.16). So, your best mitigations are:

     * Do not expose CUPS over the network with a shared PostScript queue – or at all
     * If you must use a shared queue, require auth for job submissions to that queue
     * Make sure your CUPS runs under a reasonable AppArmor/SELinux/etc. policy,
       so that the impact is minimized even if you are targeted


Further details, including about how the bugs were found and the PoC can be
found in the blog post at https://heyitsas.im/posts/cups/ and the article at
https://www.theregister.com/2026/04/06/ai_agents_cups_server_rce/

The CUPS maintainers have published advisories for the above at:

 CVE-2026-34980:
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf

 CVE-2026-34990:
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp

Additionally, in the past week they've also published advisories for:

 CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9

 CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write
   outside CacheDir/rss (and clobbering of job.cache)
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr

 CVE-2026-34979: Heap overflow in `get_options()`
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh

 CVE-2026-39314: Integer underflow in `_ppdCreateFromIPP` causes root cupsd
   crash via negative `job-password-supported`
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7

 CVE-2026-39316: Use-after-free in `cupsdDeleteTemporaryPrinters` via dangling
   subscription pointer
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg

 <no CVE>: Out-of-bounds heap read in cupsdSetPrinterAttr marker-types parsing
   https://github.com/OpenPrinting/cups/security/advisories/GHSA-qfp8-9frx-5j48

Some more gnarly issues here unfortunately

[Douglas R. Reno]

Upstream has released 2.4.17!

[Joe Locash]

Changes in CUPS v2.4.17 (2026-04-17)
------------------------------------

- CVE-2026-27447: The scheduler treated local user and group names as case-
  insensitive.
- CVE-2026-34978: The RSS notifier could write outside the scheduler's RSS
  directory.
- CVE-2026-34980: The scheduler did not filter control characters from option
  values.
- CVE-2026-34979: The scheduler did not always allocate enough memory for a
  job's options string.
- CVE-2026-34990: The scheduler incorrectly allowed local certificates over the
  loopback interface.
- CVE-2026-39314: Fixed the range check for job password strings.
- CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
- CVE-2026-NNNNN: Fixed a SNMP string conversion bug in the backends.
- The scheduler followed symbolic links when cleaning out its temporary
  directory (Issue #1448)
- Updated `cupsFileGetConf` and `cupsFilePutConf` to escape more characters.
- Updated man page `cancel` (Issue #984)
- Updated `cupsRasterReadHeader` to validate more of the page header values
  (Issue #1501)
- Fixed an issue with the class/printer CGI name checking.
- Fixed infinite loop in `http_write()` on busy print servers (Issue #827)
- Fixed potential TLS blocking issues (Issue #1128)
- Fixed a job history bug in the scheduler (Issue #1440)
- Fixed notifier logging bug that would result in nul bytes getting into the
  log (Issue #1450)
- Fixed possible use-after-free in `cupsdReadClient()` (Issue #1454)
- Fixed a document format bug in the IPP backend (Issue #1457)
- Fixed DRAIN_OUTPUT race condition (Issue #1461)
- Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions were mixed.
- Fixed the mapping of supply type keywords to SNMP names.
- Fixed a bug in the IPP backend when SNMP was disabled.
- Fixed a crash bug in the rastertoepson filter.
- Fixed a bug in cgiCheckVariables.
- Fixed handling read/write errors with OpenSSL (Issue #1506)
- Fixed handling rehandshake error in `_httpTLSRead` (Issue #1508)
- Fixed a debug printf bug on Windows (Issue #1529)
- Fixed a recursion issue with encoding of nested collections (Issue #1539)
- Fixed parsing of the `LimitRequestBody`, `MaxLogSize`, and `MaxRequestSize`
  directives in "cupsd.conf" (Issue #1540)
- Fixed a parsing bug in `ipptool` (Issue #1542)
- Fixed blank line detection in the `rastertolabel` filter (Issue #1545)
- Fixed `httpPeek` edge case on compressed streams

Fixed at ad0ddcb623. Leaving open for SA.

[Douglas R. Reno]

SA-13.0-052 issued. This was a bit of a gnarly one, all users who have CUPS installed on their system and have it enabled or configured should consider updating immediately.