From 97eca5a0b1a480d951e215b9e99596579d606554 Mon Sep 17 00:00:00 2001 From: zhouwenpei Date: Wed, 28 Jun 2023 07:09:20 +0000 Subject: [PATCH] fix CVE-2023-34241 --- backport-CVE-2023-34241.patch | 65 +++++++++++++++++++++++++++++++++++ cups.spec | 6 +++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-34241.patch diff --git a/backport-CVE-2023-34241.patch b/backport-CVE-2023-34241.patch new file mode 100644 index 0000000..8f1d863 --- /dev/null +++ b/backport-CVE-2023-34241.patch @@ -0,0 +1,65 @@ +From ffd290b4ab247f82722927ba9b21358daa16dbf1 Mon Sep 17 00:00:00 2001 +From: Rose <83477269+AtariDreams@users.noreply.github.com> +Date: Thu, 1 Jun 2023 11:33:39 -0400 +Subject: [PATCH] Log result of httpGetHostname BEFORE closing the connection + +httpClose frees the memory of con->http. This is problematic because httpGetHostname then tries to access the memory it points to. + +We have to log the hostname first. + +Reference:https://github.com/OpenPrinting/cups/commit/9809947a959e18409dcf562a3466ef246cb90cb2 +Conflict:NA +--- + scheduler/client.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/scheduler/client.c b/scheduler/client.c +index 91e441188c..327473a4d1 100644 +--- a/scheduler/client.c ++++ b/scheduler/client.c +@@ -193,13 +193,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + /* + * Can't have an unresolved IP address with double-lookups enabled... + */ +- +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "Name lookup failed - connection from %s closed!", ++ "Name lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); + ++ httpClose(con->http); + free(con); + return; + } +@@ -235,11 +233,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + * with double-lookups enabled... + */ + +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, +- "IP lookup failed - connection from %s closed!", ++ "IP lookup failed - closing connection from %s!", + httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } +@@ -256,11 +254,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */ + + if (!hosts_access(&wrap_req)) + { +- httpClose(con->http); +- + cupsdLogClient(con, CUPSD_LOG_WARN, + "Connection from %s refused by /etc/hosts.allow and " + "/etc/hosts.deny rules.", httpGetHostname(con->http, NULL, 0)); ++ ++ httpClose(con->http); + free(con); + return; + } + diff --git a/cups.spec b/cups.spec index 1323940..741a8ae 100644 --- a/cups.spec +++ b/cups.spec @@ -3,7 +3,7 @@ Name: cups Epoch: 1 Version: 2.4.0 -Release: 7 +Release: 8 Summary: CUPS is the standards-based, open source printing system for linux operating systems. License: GPLv2+ and LGPLv2+ with exceptions and AML Url: https://openprinting.github.io/cups/ @@ -28,6 +28,7 @@ Patch6000: backport-CVE-2022-26691.patch Patch6001: backport-Remove-legacy-code-for-RIP_MAX_CACHE-environment-variable.patch Patch6002: backport-Also-fix-cupsfilter.patch Patch6003: backport-CVE-2023-32324.patch +Patch6004: backport-CVE-2023-34241.patch BuildRequires: pam-devel pkgconf-pkg-config pkgconfig(gnutls) libacl-devel openldap-devel pkgconfig(libusb-1.0) BuildRequires: krb5-devel pkgconfig(avahi-client) systemd pkgconfig(libsystemd) pkgconfig(dbus-1) python3-cups @@ -452,6 +453,9 @@ rm -f %{_exec_prefix}/lib/cups/backend/smb %doc %{_datadir}/%{name}/www/apple-touch-icon.png %changelog +* Wed Jun 28 2023 zhouwenpei - 1:2.4.0-8 +- fix CVE-2023-34241 + * Mon Jun 5 2023 zhangpan - 1:2.4.0-7 - fix build error -- Gitee