Skip to content
OpenAdvisories
Medium ALAS2-2025-3028 1 CVE

Moderate: cups security update (Amazon Linux 2)

Published Oct 14, 2025 · Updated Oct 14, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-58060: A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize() function, the password is not checked. This vulnerability allows attackers to bypass authentication entirely, resulting in unauthorized access to administrative functions and system configuration.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 cups 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-client 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-debuginfo 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-devel 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-filesystem 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-ipptool 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-libs 1:1.6.3-51.amzn2.0.7
Amazon Linux · 2 cups-lpd 1:1.6.3-51.amzn2.0.7

Vulnerabilities 1

  • High 8.0
    CVE-2025-58060 Public exploit

    cups has Authentication bypass with AuthType Negotiate

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password…

    OpenPrinting cups cups cups Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-58060.html