REDHAT-BUG-2530991: Low severity OpenPrinting CUPS vulnerability
The OpenPrinting CUPS project contains two instances of case-insensitive username comparisons in authorization-adjacent code paths that were not addressed by the original CVE-2026-27447 fix. These exist in the printer ACL validation logic and private-attribute filtering mechanisms:
1. scheduler/ipp.c:checkquotas() - uses cupsstrcasecmp() for printer ACL username matching 2. scheduler/policy.c:cupsdGetPrivateAttrs() - uses cupsstrcasecmp() for @OWNER and explicit username checks
These patterns were removed from the primary authorization path in the original CVE-2026-27447 fix but persist in these secondary paths.
Affected versions: < 2.4.20. No patched release listed at time of advisory (fixes committed but not yet released).
Reference: https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
OpenPrinting CUPS versions earlier than 2.4.20 are affected. The issue is present in printer ACL quota validation and private-attribute filtering paths.
What access would an attacker need to exploit this?
The advisory identifies case-insensitive comparisons of usernames in authorization-adjacent logic, including printer ACL matching and @OWNER or explicit username checks. It does not specify the required attacker access level or a complete exploitation scenario.
Is a released update available?
No patched release is listed at the time of the advisory. Fixes have been committed but had not yet been released.
What can be done while waiting for a release?
The provided information does not list a workaround. Review printer ACL and private-attribute access configurations, particularly where usernames that differ only by letter case could be treated as distinct identities.