Bug 13831

Summary:	[CVE 21] cups 2.3.3op2 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	critical
Priority:	Highest	CC:	a.proklov, e.kosachev, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	2021.1 Fresh R12
Hardware:	All
OS:	Linux
URL:	CVE-2022-26691, CVE-2023-34241,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-10-18 20:24:48 MSK

Please patch CVEs for package cups version 2.3.3op2
  
INFO (CVEs are): cups 2.3.3op2
 cves found
CVE-2022-26691
Desc: A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-26691
Severity: MEDIUM
CVE-2023-34241
Desc: OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.

The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.

Version 2.4.6 has a patch for this issue.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-34241
Severity: HIGH

Comment 1 Svyatoslav Matveev 2023-10-19 22:27:10 MSK

********** QA ADVISORY **********
Cve закрыто патчами.

*** cups
**  version 2.3.3op2 release +1

https://abf.io/build_lists/4758982
https://abf.io/build_lists/4758981
https://abf.io/build_lists/4758983
https://abf.io/build_lists/4758984
https://abf.io/build_lists/4758985

Comment 2 Yury 2023-10-19 23:10:46 MSK

secteam_verified

Comment 3 Dmitry Postnikov 2023-10-24 09:30:25 MSK

*****************************
Обновление отослано в Тестинг

Comment 4 Vladimir Potapov 2023-10-24 15:12:36 MSK

cups-2.3.3op2-7
https://abf.io/build_lists/4758982
https://abf.io/build_lists/4758981
https://abf.io/build_lists/4758983
https://abf.io/build_lists/4758984
https://abf.io/build_lists/4758985
************************ Advisory ****************************
CVE-2023-34241 fix
**************************************************************
QA Verified

Comment 5 Aleksandr Proklov 2023-10-25 12:31:04 MSK

*** Bug 13508 has been marked as a duplicate of this bug. ***