[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e8047bef-b5b9-40c4-8027-cf140d031559@redhat.com>
Date: Fri, 27 Sep 2024 02:09:52 +0200
From: Zdenek Dohnal <zdohnal@...hat.com>
To: Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com,
Michael Sweet <msweet@...eet.org>
Cc: Simone Margaritelli <evilsocket@...il.com>
Subject: Re: CUPS printing system vulnerabilities
Hi Alex,
Mike has more info about those commits, I've added him in the loop here.
I'm sorry that I cannot provide much more info - there is Fedora commit
from Justin https://src.fedoraproject.org/rpms/cups/c/d0eba90f305d which
should cover Mike's fixes, but I don't know which was for which issue.
Zdenek
On 9/27/24 01:49, Solar Designer wrote:
> On Thu, Sep 26, 2024 at 03:43:23PM -0700, Alan Coopersmith wrote:
>> On 9/26/24 15:11, Solar Designer wrote:
>>> A lot of drama around the disclosure of those issues was going on for
>>> maybe a month now, with public tweets about the disclosure process and
>>> the issues affecting many distros but excluding detail on the issues
>>> (not even CUPS was specifically mentioned until very recently). Per
>>> those tweets, the issues were communicated to some distro vendors via
>>> CERT/CC VINCE and a vendor planned to bring them to the distros list on
>>> September 30 with public disclosure on October 6. Unfortunately, the
>>> information leaked prematurely and thus Simone decided on full public
>>> disclosure today at 20:00 UTC pre-announcing it only 2 hours in advance.
>> Once it was learned that the information was leaked, the vendors suggested
>> ending the embargo today, and both evilsocket & OpenPrinting agreed to it,
>> with the coordinated end at 20:00 UTC.
> Thanks Alan! On Twitter, Alan further clarified that "once it was clear
> the info was out there, the distro makers wanted to end the embargo so
> they could publish advisories telling users to disable cups-browsed
> instead of waiting for patches to be available - those with VINCE access
> had hours of prior notice, not just two."
>
> I apologize to Simone for the unnecessary and wrong guess on whose
> decision it was. I didn't have that information and shouldn't have
> included a guess.
>
>> OpenPrinting has started publishing fixes as well now:
>>
>> CVE-2024-47175: https://github.com/OpenPrinting/libppd/commit/d681747ebf
>> CVE-2024-47076:
>> https://github.com/OpenPrinting/libcupsfilters/commit/95576ec3
>>
>> and a temporary workaround for CVE-2024-47176 in:
>> https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c
> Thanks. I guess also this from a few days ago? -
>
> https://github.com/OpenPrinting/cups/commit/8361420cbbfa2e729545c4c537c49fc6322c9631
>
> "Escape localized strings in PPDs", which is similar to the last hunk in
> "Prevent PPD generation based on invalid IPP response" CVE-2024-47175
> libppd commit referenced by Alan above.
>
> Possibly unrelated to today's disclosure but also security-relevant is:
>
> https://github.com/OpenPrinting/cups/commit/e3467edf3be2d20a022495d9726a741e36768caf
>
> "Update httpConnectURI to do X.509 pinning, and use it when doing the IPP"
>
> Zdenek, I hope you will soon clarify which commits fix what issues, to
> assist with distro backports. I understand you're still busy getting
> these in now and it's probably night time for you, so follow up when you
> have a moment later, please.
>
> Thanks,
>
> Alexander
>
--
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
