Description
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.20final+rc1-1 | — |
| Debian 13 | cups | 1.1.20final+rc1-1 | — |
| Debian 12 | cups | 1.1.20final+rc1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | cups +2 | 1:1.1.17-13.3.29 | RHSA-2005:571 |
Advisories 1
- RHSA-2005:571 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- SUSE-SR:2005:018 vendor-advisory
- http://www.cups.org/str.php?L700
- RHSA-2005:571 vendor-advisory
- FLSA:163274 vendor-advisory
- USN-185-1 vendor-advisory
- oval:org.mitre.oval:def:9940 vdb-entry signature
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162405