Repository navigation
fix(cve): CVE-2026-55480 - Open temporary PPD files more securely. - #32
Merged
Merged
Conversation
CVE: CVE-2026-55480 (medium) - cups 中存在临时 PPD 文件打开时的安全漏洞，攻击者可能通过符号链接攻击导致任意文件写入或信息泄露，需要通过添加 O_EXCL 与 O_NOFOLLOW 标志来安全打开临时 PPD 文件。 Upstream: OpenPrinting/cups@98adfd8 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
Author
|
/hold |
|
TAG Bot TAG: 2.4.16-1deepin21 |
…normalize the logging punctuat CVE: CVE-2026-61702 (medium) - Validate attributes-natural-language, and normalize the logging punctuation. Upstream: OpenPrinting/cups@08a8a27 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…ne away (GHSA-qqm8-4q5h-jg55) CVE: CVE-2026-107888 (medium) - Held jobs for temporary print queues could crash the scheduler (GHSA-qqm8-4q5h-jg55) Upstream: OpenPrinting/cups@c5fc041 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…reeing (GHSA-pwg4-pv39-8c22) CVE: CVE-2026-107886 (low) - The scheduler could crash when modifying a class (GHSA-pwg4-pv39-8c22); initialize printers array to NULL after freeing Upstream: OpenPrinting/cups@13bc9d4 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…ing values. CVE: CVE-2026-55467 (low) - CUPS get_options 函数中 destination-uri 和 pre-dial-string 值未做清洗，可能允许通过控制字符进行注入攻击（低危）。 Upstream: OpenPrinting/cups@0cf4e78 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…s and quotas. CVE: CVE-2026-87876 (low) - Quota and policy operations did not treat usernames as case-sensitive. This could allow a user to bypass policy and quota restrictions by using a different case for their username. Upstream: https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8.patch Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…on requests (GHSA-wjc4-qhjr-5m5 CVE: CVE-2026-107890 (low) - Filter out group separators in job creation requests Upstream: OpenPrinting/cups@f3fb419 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…nger than the multiple-operatio CVE: CVE-2026-107885 (low) - Don't allow clients to hold a job open longer than the multiple-operation-time-out value (GHSA-hhw5-qqmc-p6rg) Upstream: OpenPrinting/cups@6c61d23 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
CVE: CVE-2026-55453 (low) - The backend did not sanitize IPP attribute strings, potentially allowing control characters to be injected into output. Upstream: OpenPrinting/cups@d41cf06 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
CVE: CVE-2026-87875 (medium) - 修复 64 位系统上的 UTF-32 数据类型问题，将 transcode.h 中的 Unicode 类型改为使用固定宽度整数类型，避免依赖平台相关的 unsigned long/short 宽度。 Upstream: OpenPrinting/cups@2b1dc17 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
CVE: CVE-2026-87875 - 补充缺失的 #include <stdint.h>，修复 transcode.h 使用 uint32_t/uint16_t 却未包含精确宽度整数类型声明的兼容性问题（与上游提交 2b1dc178 一致） Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…ticket comment support, and dis CVE: CVE-2026-107655 (medium) - Job ticket comments could cause the scheduler to crash (GHSA-58wv-9ffm-5w78); added JobTicketComments directive to cups-files.conf to enable job ticket comment support (disabled by default). Upstream: OpenPrinting/cups@25d6830 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
Contributor
合并 PR #31已将 #31（CVE-2026-87875、CVE-2026-107655，共 3 个 commit）合并进本 PR。分支现包含 11 个 CVE 修复、12 个 commit。 合并处理：
验证（本地 debian trixie，与 OBS 相同的
|
… fix sendmail usage (GHSA-r4wf- CVE: CVE-2026-105326 (low) - CUPS mailto 通知器未校验 notify-recipient-uri 与 notify-user-data 中的邮件地址，且未使用 sendmail -t 读取收件人，攻击者可通过构造的 mailto URI 注入邮件头或影响命令调用；本补丁新增地址校验函数并改用 sendmail -t 读取收件人。 Upstream: OpenPrinting/cups@611d1bd Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…on (Issue #1744) CVE-2026-105326 的修复引入了地址校验回归：`copy_validate_address()` 中 “连续句点”检查写在 else-if 链里，条件不成立时会落入下一个字符白名单 分支，而 '.' 不在白名单中，导致任何含点的地址（如 user@example.com） 都被判为非法，mailto 通知器因此不再发送任何通知。 上游 4c5a1559 将 '.' 独立成一个分支，只拒绝开头、连续以及 '@' 之后的 句点，行为恢复正常。 Upstream: OpenPrinting/cups@4c5a155 Issue: OpenPrinting/cups#1744
|
TAG Bot New tag: 2.4.16-1deepin21 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-55480 (medium) - cups 中存在临时 PPD 文件打开时的安全漏洞，攻击者可能通过符号链接攻击导致任意文件写入或信息泄露，需要通过添加 O_EXCL 与 O_NOFOLLOW 标志来安全打开临时 PPD 文件。
Upstream: OpenPrinting/cups@98adfd8
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-61702 (medium) - Validate attributes-natural-language, and normalize the logging punctuation.
Upstream: OpenPrinting/cups@08a8a27
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-107888 (medium) - Held jobs for temporary print queues could crash the scheduler (GHSA-qqm8-4q5h-jg55)
Upstream: OpenPrinting/cups@c5fc041
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-107886 (low) - The scheduler could crash when modifying a class (GHSA-pwg4-pv39-8c22); initialize printers array to NULL after freeing
Upstream: OpenPrinting/cups@13bc9d4
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-55467 (low) - CUPS get_options 函数中 destination-uri 和 pre-dial-string 值未做清洗，可能允许通过控制字符进行注入攻击（低危）。
Upstream: OpenPrinting/cups@0cf4e78
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-87876 (low) - Quota and policy operations did not treat usernames as case-sensitive. This could allow a user to bypass policy and quota restrictions by using a different case for their username.
Upstream: https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8.patch
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-107890 (low) - Filter out group separators in job creation requests
Upstream: OpenPrinting/cups@f3fb419
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-107885 (low) - Don't allow clients to hold a job open longer than the multiple-operation-time-out value (GHSA-hhw5-qqmc-p6rg)
Upstream: OpenPrinting/cups@6c61d23
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-55453 (low) - The backend did not sanitize IPP attribute strings, potentially allowing control characters to be injected into output.
Upstream: OpenPrinting/cups@d41cf06
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-87875 - 补充缺失的 #include <stdint.h>，修复 transcode.h 使用 uint32_t/uint16_t 却未包含精确宽度整数类型声明的兼容性问题（与上游提交 2b1dc178 一致）
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-107655 (medium) - Job ticket comments could cause the scheduler to crash (GHSA-58wv-9ffm-5w78); added JobTicketComments directive to cups-files.conf to enable job ticket comment support (disabled by default).
Upstream: OpenPrinting/cups@25d6830
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-105326 (low) - CUPS mailto 通知器未校验 notify-recipient-uri 与 notify-user-data 中的邮件地址，且未使用 sendmail -t 读取收件人，攻击者可通过构造的 mailto URI 注入邮件头或影响命令调用；本补丁新增地址校验函数并改用 sendmail -t 读取收件人。
Upstream: OpenPrinting/cups@611d1bd
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash