Moderate: cups security update
Summary
ALSA-2024:4265: Moderate: cups security update. Affects cups versions < 1:2.2.6-60.el8_10. Fixed in 1:2.2.6-60.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Common UNIX Printing System (CUPS) is a portable printing layer for Linux, UNIX, and similar operating systems. It provides a framework for managing print jobs, printer discovery, and printer sharing. CUPS is widely used in various environments, including desktops, servers, and embedded systems.
Vulnerability Detail
The vulnerability in CUPS, identified as CVE-2024-35235, allows an attacker to perform an arbitrary chmod operation on the cupsd Listen directive. This can result in the cupsd process being configured to listen on a privileged port or a port that is accessible to unauthorized users. An attacker with network access to the affected system could potentially exploit this vulnerability to gain elevated privileges or perform further attacks.
How To Fix
Minimum fixed version
1:2.2.6-60.el8_10
This is the first release that contains the fix.
sudo dnf update cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The vulnerability in CUPS allows an attacker to modify the cupsd configuration, potentially leading to unauthorized access or privilege escalation. It is crucial to update the cups package to the recommended version to mitigate the risk of exploitation.
See every vulnerability recorded for cups →
FAQ
CUPS is the Common UNIX Printing System, a printing framework used in Linux, UNIX, and similar operating systems.
The vulnerability allows an attacker to modify the configuration of the cupsd process, potentially leading to unauthorized access or privilege escalation.
To fix this vulnerability, update the cups package to version 2.2.6-60.el8_10 or later.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about this vulnerability in the CVE page listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
