CVE-2023-24805: Command injection in cups-filters

Q: What is CVE-2023-24805?

CVE-2023-24805 is a vulnerability found in cups-filters that can lead to remote code execution if the Backend Error Handler (beh) is used to create an accessible network printer.

Q: How does the vulnerability in cups-filters occur?

The vulnerability in cups-filters occurs when the Backend Error Handler (beh) is used to create an accessible network printer.

Q: What is the severity of CVE-2023-24805?

CVE-2023-24805 has a severity rating of 8.8, indicating a high severity.

Q: What software versions are affected by CVE-2023-24805?

The affected software versions include cups-filters 1.20.0-29.el8_8.2, 1.20.0-18.el8_1, 1.20.0-19.el8_2, 1.20.0-24.el8_4, 1.20.0-27.el8_6, 1.28.7-11.el9_2.1, and 1.28.7-10.el9_0.1.

Q: How can I mitigate or fix the vulnerability in cups-filters?

To mitigate the vulnerability in cups-filters, it is recommended to update to the latest version of the software, such as cups-filters 1.21.6-5+deb10u1, 1.28.7-1+deb11u2, or 1.28.17-3, depending on your distribution.

Published May 11, 2023

Updated

A vulnerability was found in cups-filters. This security flaw occurs if you use beh to create an accessible network printer, possibly resulting in remote code execution.

Other sources

beh backend: Use execv() instead of system() - CVE-2023-24805

If you use "beh" to create an accessible network printer, this security vulnerability can cause remote code execution. https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-gpxc-v2m8-fr3x

— Red Hat

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. beh.c contains the line retval = system(cmdline) >> 8; which calls the system command with the operand cmdline. cmdline contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit 8f2740357 and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime.

Affected Software

25 affected componentsFixes available

redhat/cups-filters<0:1.20.0-29.el8_8.2

0:1.20.0-29.el8_8.2

redhat/cups-filters<0:1.20.0-18.el8_1.1

0:1.20.0-18.el8_1.1

redhat/cups-filters<0:1.20.0-19.el8_2.1

0:1.20.0-19.el8_2.1

redhat/cups-filters<0:1.20.0-24.el8_4.1

0:1.20.0-24.el8_4.1

redhat/cups-filters<0:1.20.0-27.el8_6.1

0:1.20.0-27.el8_6.1

redhat/cups-filters<0:1.28.7-11.el9_2.1

0:1.28.7-11.el9_2.1

redhat/cups-filters<0:1.28.7-10.el9_0.1

0:1.28.7-10.el9_0.1

debian/cups-filters<=1.21.6-5

1.21.6-5+deb10u11.28.7-1+deb11u21.28.17-3

debian/cups-filters<=1.28.7-1, <=1.28.7-1+deb11u1, <=1.28.17-2

1.28.17-31.28.7-1+deb11u2

linuxfoundation cups-filters<2.0

linuxfoundation cups-filters=2.0-beta1

linuxfoundation cups-filters=2.0-beta2

linuxfoundation cups-filters=2.0-beta3

linuxfoundation cups-filters=2.0-rc1

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Debian Debian Linux=10.0

Debian Debian Linux=11.0

alpine/cups-filters<1.28.17-r2

1.28.17-r2