Package: cups Version: 2.4.2-3+deb12u8 Severity: important Tags: fixed-upstream X-Debbugs-Cc: r2zqj...@dumper.anonaddy.com
Hello Debian Printing Team, version 2.4.2 of cups contains an XSS vulnerability that was fixed in commit 988ddfd[0] and published in release v2.4.8[1]. Exploitation is trivial: "https://localhost:631/admin?DEBUG_LOGGING=onfocus=alert(1) autofocus=" However, no CVE was assigned, so no one backported this patch to 2.4.2-3+deb12u8. The vulnerability was detected by Tenable, which performs various fuzzing scans. *** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? * What exactly did you do (or not do) that was effective (or ineffective)? * What was the outcome of this action? * What outcome did you expect instead? *** End of the template - remove these template lines *** [0] https://github.com/OpenPrinting/cups/commit/988ddfd9e66affdb4ed8714c30de96fb304ef4cb [1] https://github.com/OpenPrinting/cups/releases/tag/v2.4.8 -- System Information: Debian Release: 12.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable'), (100, 'bookworm-fasttrack') Architecture: amd64 (x86_64) Kernel: Linux 6.1.0-28-amd64 (SMP w/3 CPU threads; PREEMPT) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE, TAINT_LIVEPATCH Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages cups depends on: pn cups-client <none> pn cups-common <none> pn cups-core-drivers <none> pn cups-daemon <none> pn cups-filters <none> pn cups-ppdc <none> pn cups-server-common <none> ii debconf [debconf-2.0] 1.5.82 pn ghostscript <none> ii libavahi-client3 0.8-10 ii libavahi-common3 0.8-10 ii libc6 2.36-9+deb12u9 ii libcups2 2.4.2-3+deb12u8 ii libgcc-s1 12.2.0-14 ii libstdc++6 12.2.0-14 ii libusb-1.0-0 2:1.0.26-1 pn poppler-utils <none> ii procps 2:4.0.2-3 Versions of packages cups recommends: pn avahi-daemon <none> pn colord <none> Versions of packages cups suggests: pn cups-bsd <none> pn cups-pdf <none> pn foomatic-db-compressed-ppds | foomatic-db <none> pn smbclient <none> ii udev 252.31-1~deb12u1
