DSA-5149: -1 cups -- security update

Published May 26, 2022

Updated

cups - security update

Other sources

Joshua Mason discovered that a logic error in the validation of the secret key used in the local authorisation mode of the CUPS printing system may result in privilege escalation.

Affected Software

2 affected components

debian/cups

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cups to a version that resolves this vulnerability.
Patch DSA-5149-1

Event History

May 26, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-26691

Frequently Asked Questions

Who could exploit this issue?

An attacker would need to interact with the local authorisation mode of the CUPS printing system. The issue may allow privilege escalation because of incorrect validation of the secret key used by that mode.

How can I determine whether my system is exposed?

Check whether the affected Debian CUPS installation uses local authorisation mode. Systems not using that mode are not identified in the advisory description as exposed to this secret-key validation flaw.

What should I do if I cannot update immediately?

Where operationally possible, avoid using CUPS local authorisation mode until the security update can be applied. The provided information does not describe another mitigation.

DSA-5149: -1 cups -- security update

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could exploit this issue?

How can I determine whether my system is exposed?

What should I do if I cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit this issue?

How can I determine whether my system is exposed?

What should I do if I cannot update immediately?