Moderate: cups security update
Summary
ALSA-2024:4776: Moderate: cups security update. Affects cups versions < 1:2.3.3op2-27.el9_4. Fixed in 1:2.3.3op2-27.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Common UNIX Printing System (CUPS) is a portable printing layer for Linux, UNIX, and similar operating systems. It provides a framework for managing print jobs and printer queues, as well as handling printer drivers and communication protocols.
Vulnerability Detail
The vulnerability in CUPS, identified as CVE-2024-35235, allows an attacker to perform an arbitrary chmod operation on the cupsd Listen directive. This can result in the cupsd process being configured with excessively permissive permissions (0140777), potentially leading to unauthorized access or privilege escalation.
How To Fix
Minimum fixed version
1:2.3.3op2-27.el9_4
This is the first release that contains the fix.
sudo dnf update cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The vulnerability in CUPS allows an attacker to modify the permissions of the cupsd Listen directive, potentially leading to unauthorized access or privilege escalation. It is recommended to update the cups package to version 1:2.3.3op2-27.el9_4 or later to mitigate this vulnerability.
See every vulnerability recorded for cups →
FAQ
CUPS is the Common UNIX Printing System, a printing framework used in Linux, UNIX, and similar operating systems.
The vulnerability allows an attacker to modify the permissions of the cupsd Listen directive, potentially leading to unauthorized access or privilege escalation.
You can check the version of the cups package installed on your system. If it is earlier than 1:2.3.3op2-27.el9_4, your system may be vulnerable.
There are no known exploits for this vulnerability at this time.
Yes, a fix is available in the form of an update to the cups package. It is recommended to update to version 1:2.3.3op2-27.el9_4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
