OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword.
The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d…
security-advisories@github.com
https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36e…
security-advisories@github.com
https://github.com/OpenPrinting/cups/releases/tag/v2.4.20
security-advisories@github.com
https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v
security-advisories@github.com