From 416535b685b05cb0c8a613a74fb48274732df7b2 Mon Sep 17 00:00:00 2001 From: zhouwenpei Date: Mon, 26 Jun 2023 06:52:18 +0000 Subject: [PATCH] fix CVE-2023-34241 (cherry picked from commit 1c561cc745163b67507346dadc1852025f2f9536) --- backport-CVE-2023-34241.patch | 65 +++++++++++++++++++++++++++++++++++ cups.spec | 6 +++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-34241.patch diff --git a/backport-CVE-2023-34241.patch b/backport-CVE-2023-34241.patch new file mode 100644 index 0000000..8f1d863 --- /dev/null +++ b/backport-CVE-2023-34241.patch @@ -0,0 +1,65 @@ +From ffd290b4ab247f82722927ba9b21358daa16dbf1 Mon Sep 17 00:00:00 2001 +From: Rose <83477269+AtariDreams@users.noreply.github.com> +Date: Thu, 1 Jun 2023 11:33:39 -0400 +Subject: [PATCH] Log result of httpGetHostname BEFORE closing the connection + +httpClose frees the memory of con->http. This is problematic because httpGetHostname then tries to access the memory it points to. + +We have to log the hostname first. + +Reference:https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2 +Conflict:NA +--- + scheduler/client.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/scheduler/client.c b/scheduler/client.c +index 91e441188c..327473a4d1 100644 +--- a/scheduler/client.c ++++ b/scheduler/client.c +@@ -193,13 +193,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + /* + * Can't have an unresolved IP address with double-lookups enabled... + */ +- +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "Name lookup failed - connection from %s closed!", ++ "Name lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); + ++ httpClose(con->http); + free(con); + return; + } +@@ -235,11 +233,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + * with double-lookups enabled... + */ + +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "IP lookup failed - connection from %s closed!", ++ "IP lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } +@@ -256,11 +254,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + + if (!hosts_access(&wrap_req)) + { +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, + "Connection from %s refused by /etc/hosts.allow and " + "/etc/hosts.deny rules.", httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } + diff --git a/cups.spec b/cups.spec index af8b6bc..3ace7aa 100644 --- a/cups.spec +++ b/cups.spec @@ -3,7 +3,7 @@ Name: cups Epoch: 1 Version: 2.4.0 -Release: 7 +Release: 8 Summary: CUPS is the standards-based, open source printing system for linux operating systems. License: GPLv2+ and LGPLv2+ with exceptions and AML Url: https://openprinting.github.io/cups/ @@ -29,6 +29,7 @@ Patch6001: backport-Remove-legacy-code-for-RIP_MAX_CACHE-environment-variable.pa Patch6002: backport-Also-fix-cupsfilter.patch Patch6003: backport-CVE-2023-32324.patch Patch6004: fix-httpAddrGetList-test-case-fail.patch +Patch6005: backport-CVE-2023-34241.patch BuildRequires: pam-devel pkgconf-pkg-config pkgconfig(gnutls) libacl-devel openldap-devel pkgconfig(libusb-1.0) BuildRequires: krb5-devel pkgconfig(avahi-client) systemd pkgconfig(libsystemd) pkgconfig(dbus-1) python3-cups @@ -450,6 +451,9 @@ rm -f %{_exec_prefix}/lib/cups/backend/smb %doc %{_datadir}/%{name}/www/apple-touch-icon.png %changelog +* Mon Jun 26 2023 zhouwenpei - 1:2.4.0-8 +- fix CVE-2023-34241 + * Fri Jun 9 2023 zhangpan - 1:2.4.0-7 - fix build error -- Gitee