Vulnerability-Lookup

OESA-2025-2334 (CVE-2025-58060)

Vulnerability from osv_openeuler – Published: 2025-09-26 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

cups security update

Details

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

'Hi all,\n\nthere is important security vulnerability in CUPS:\n\n\n\xa0\xa0 Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details', 'PoC\n\n- Configure CUPS with |DefaultAuthType Negotiate|.\n- Start CUPS', '- cat /etc/cups/cupsd.conf\nhaha\n\n\n\xa0\xa0\xa0\xa0 Impact', 'Patch', 'Have a nice day,\n\n\nZdenek Dohnal\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'

'Hi all!', 'Description\n\n\n\xa0\xa0\xa0\xa0 Summary', 'Details\n\nThe combination of:', 'Is shown in two places in OpenPrinting:\n\n|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c |', 'PoC', 'Impact', 'Metrics:\n\n\n\xa0\xa0\xa0\xa0\xa0\xa0 CVSS v3 base metrics\n\nAttack vector Adjacent\nAttack complexity Low\nPrivileges required None\nUser interaction None\nScope Unchanged\nConfidentiality None\nIntegrity None\nAvailability High\n\nCredit -', 'Patch', 'Have a nice day!\n\n\nZdenek\n\n--\nZdenek Dohnal\nSenior Software Engineer\nRed Hat, BRQ-TPBC'

Severity

8.0 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-58060	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-58364	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-client-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-devel-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-libs-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "cups-filesystem-2.4.7-7.oe2403sp2.noarch.rpm",
          "cups-help-2.4.7-7.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "cups-2.4.7-7.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "cups-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-client-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-devel-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-libs-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-7.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.2.13-22.oe2003sp4.aarch64.rpm",
          "cups-debuginfo-2.2.13-22.oe2003sp4.aarch64.rpm",
          "cups-debugsource-2.2.13-22.oe2003sp4.aarch64.rpm",
          "cups-devel-2.2.13-22.oe2003sp4.aarch64.rpm",
          "cups-libs-2.2.13-22.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "cups-help-2.2.13-22.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "cups-2.2.13-22.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "cups-2.2.13-22.oe2003sp4.x86_64.rpm",
          "cups-debuginfo-2.2.13-22.oe2003sp4.x86_64.rpm",
          "cups-debugsource-2.2.13-22.oe2003sp4.x86_64.rpm",
          "cups-devel-2.2.13-22.oe2003sp4.x86_64.rpm",
          "cups-libs-2.2.13-22.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.13-22.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-client-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-debuginfo-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-debugsource-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-devel-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-ipptool-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-libs-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-lpd-2.4.0-15.oe2203sp3.aarch64.rpm",
          "cups-printerapp-2.4.0-15.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "cups-filesystem-2.4.0-15.oe2203sp3.noarch.rpm",
          "cups-help-2.4.0-15.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "cups-2.4.0-15.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "cups-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-client-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-debuginfo-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-debugsource-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-devel-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-ipptool-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-libs-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-lpd-2.4.0-15.oe2203sp3.x86_64.rpm",
          "cups-printerapp-2.4.0-15.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.0-15.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-client-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-debuginfo-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-debugsource-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-devel-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-ipptool-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-libs-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-lpd-2.4.0-15.oe2203sp4.aarch64.rpm",
          "cups-printerapp-2.4.0-15.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "cups-filesystem-2.4.0-15.oe2203sp4.noarch.rpm",
          "cups-help-2.4.0-15.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "cups-2.4.0-15.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "cups-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-client-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-debuginfo-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-debugsource-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-devel-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-ipptool-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-libs-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-lpd-2.4.0-15.oe2203sp4.x86_64.rpm",
          "cups-printerapp-2.4.0-15.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.0-15.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-client-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-devel-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-libs-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp2.aarch64.rpm",
          "cups-2.4.7-7.oe2403.aarch64.rpm",
          "cups-client-2.4.7-7.oe2403.aarch64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403.aarch64.rpm",
          "cups-debugsource-2.4.7-7.oe2403.aarch64.rpm",
          "cups-devel-2.4.7-7.oe2403.aarch64.rpm",
          "cups-ipptool-2.4.7-7.oe2403.aarch64.rpm",
          "cups-libs-2.4.7-7.oe2403.aarch64.rpm",
          "cups-lpd-2.4.7-7.oe2403.aarch64.rpm",
          "cups-printerapp-2.4.7-7.oe2403.aarch64.rpm",
          "cups-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-client-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-devel-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-libs-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "cups-filesystem-2.4.7-7.oe2403sp2.noarch.rpm",
          "cups-help-2.4.7-7.oe2403sp2.noarch.rpm",
          "cups-filesystem-2.4.7-7.oe2403.noarch.rpm",
          "cups-help-2.4.7-7.oe2403.noarch.rpm",
          "cups-filesystem-2.4.7-7.oe2403sp1.noarch.rpm",
          "cups-help-2.4.7-7.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "cups-2.4.7-7.oe2403sp2.src.rpm",
          "cups-2.4.7-7.oe2403.src.rpm",
          "cups-2.4.7-7.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "cups-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-client-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-devel-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-libs-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp2.x86_64.rpm",
          "cups-2.4.7-7.oe2403.x86_64.rpm",
          "cups-client-2.4.7-7.oe2403.x86_64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403.x86_64.rpm",
          "cups-debugsource-2.4.7-7.oe2403.x86_64.rpm",
          "cups-devel-2.4.7-7.oe2403.x86_64.rpm",
          "cups-ipptool-2.4.7-7.oe2403.x86_64.rpm",
          "cups-libs-2.4.7-7.oe2403.x86_64.rpm",
          "cups-lpd-2.4.7-7.oe2403.x86_64.rpm",
          "cups-printerapp-2.4.7-7.oe2403.x86_64.rpm",
          "cups-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-client-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-devel-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-libs-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-7.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "cups-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-client-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-devel-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-libs-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp1.aarch64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "cups-filesystem-2.4.7-7.oe2403sp1.noarch.rpm",
          "cups-help-2.4.7-7.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "cups-2.4.7-7.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "cups-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-client-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-debuginfo-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-debugsource-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-devel-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-ipptool-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-libs-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-lpd-2.4.7-7.oe2403sp1.x86_64.rpm",
          "cups-printerapp-2.4.7-7.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "cups",
        "purl": "pkg:rpm/openEuler/cups\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-7.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX\u00ae-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\n[\u0026apos;Hi all,\\n\\nthere is important security vulnerability in CUPS:\\n\\n\\n\\xa0\\xa0 Description\\n\\n\\n\\xa0\\xa0\\xa0\\xa0 Summary\u0026apos;, \u0026apos;Details\u0026apos;, \u0026apos;PoC\\n\\n- Configure CUPS with |DefaultAuthType Negotiate|.\\n- Start CUPS\u0026apos;, \u0026apos;- cat /etc/cups/cupsd.conf\\nhaha\\n\\n\\n\\xa0\\xa0\\xa0\\xa0 Impact\u0026apos;, \u0026apos;Patch\u0026apos;, \u0026apos;Have a nice day,\\n\\n\\nZdenek Dohnal\\n\\n--\\nZdenek Dohnal\\nSenior Software Engineer\\nRed Hat, BRQ-TPBC\u0026apos;](CVE-2025-58060)\n\n[\u0026apos;Hi all!\u0026apos;, \u0026apos;Description\\n\\n\\n\\xa0\\xa0\\xa0\\xa0 Summary\u0026apos;, \u0026apos;Details\\n\\nThe combination of:\u0026apos;, \u0026apos;Is shown in two places in OpenPrinting:\\n\\n|cups/scheduler/ipp.c libcupsfilters/cupsfilters/ipp.c |\u0026apos;, \u0026apos;PoC\u0026apos;, \u0026apos;Impact\u0026apos;, \u0026apos;Metrics:\\n\\n\\n\\xa0\\xa0\\xa0\\xa0\\xa0\\xa0 CVSS v3 base metrics\\n\\nAttack vector Adjacent\\nAttack complexity Low\\nPrivileges required None\\nUser interaction None\\nScope Unchanged\\nConfidentiality None\\nIntegrity None\\nAvailability High\\n\\nCredit -\u0026apos;, \u0026apos;Patch\u0026apos;, \u0026apos;Have a nice day!\\n\\n\\nZdenek\\n\\n--\\nZdenek Dohnal\\nSenior Software Engineer\\nRed Hat, BRQ-TPBC\u0026apos;](CVE-2025-58364)",
  "id": "OESA-2025-2334",
  "modified": "2026-08-06T11:09:24Z",
  "published": "2025-09-26T11:09:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58060"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58364"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "cups security update",
  "upstream": [
    "CVE-2025-58060",
    "CVE-2025-58364"
  ]
}

CVE-2025-58060 (GCVE-0-2025-58060)

Vulnerability from cvelistv5 – Published: 2025-09-11 17:06 – Updated: 2025-11-04 21:13

Title

cups has Authentication bypass with AuthType Negotiate

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.

Severity

8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-11 17:33 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/OpenPrinting/cups/security/adv…	x_refsource_CONFIRM
https://github.com/OpenPrinting/cups/commit/595d6…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/09/11/1

Impacted products

1 product

Vendor	Product	Version
OpenPrinting	cups	Affected: < 2.4.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58060",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-11T17:33:32.502303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-11T17:35:59.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:22.294Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00013.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/11/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cups",
          "vendor": "OpenPrinting",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T17:25:02.915Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq"
        },
        {
          "name": "https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221"
        }
      ],
      "source": {
        "advisory": "GHSA-4c68-qgrh-rmmq",
        "discovery": "UNKNOWN"
      },
      "title": "cups has Authentication bypass with AuthType Negotiate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-58060",
    "datePublished": "2025-09-11T17:06:32.899Z",
    "dateReserved": "2025-08-22T14:30:32.222Z",
    "dateUpdated": "2025-11-04T21:13:22.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-58364 (GCVE-0-2025-58364)

Vulnerability from cvelistv5 – Published: 2025-09-11 17:26 – Updated: 2025-11-04 21:13

Title

cups: Remote DoS via null dereference

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-11 17:37 UTC

CWE

CWE-20 - Improper Input Validation
CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/OpenPrinting/cups/security/adv…	x_refsource_CONFIRM
https://github.com/OpenPrinting/cups/commit/e58cb…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/09/11/2

Impacted products

1 product

Vendor	Product	Version
OpenPrinting	cups	Affected: < 2.4.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58364",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-11T17:37:26.400376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-11T17:37:30.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:40.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00013.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/11/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cups",
          "vendor": "OpenPrinting",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups \u0026 cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector \"Network\" is possible. The current versions of CUPS and cups-browsed projects have the attack vector \"Adjacent\" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T17:26:25.282Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4"
        },
        {
          "name": "https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d"
        }
      ],
      "source": {
        "advisory": "GHSA-7qx3-r744-6qv4",
        "discovery": "UNKNOWN"
      },
      "title": "cups: Remote DoS via null dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-58364",
    "datePublished": "2025-09-11T17:26:25.282Z",
    "dateReserved": "2025-08-29T16:19:59.011Z",
    "dateUpdated": "2025-11-04T21:13:40.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2025-2334 (CVE-2025-58060)

CVE-2025-58060 (GCVE-0-2025-58060)

CVE-2025-58364 (GCVE-0-2025-58364)

Tags

Sightings

Nomenclature

Related by attack behaviour