Bug 1921680 (CVE-2020-10001)
| Summary: | CVE-2020-10001 cups: access to uninitialized buffer in ipp.c | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Michael Kaplan <mkaplan> | ||||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | medium | ||||||||||||
| Version: | unspecified | CC: | security-response-team, twaugh, zdohnal | ||||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | cups 2.3.3op2 | Doc Type: | If docs needed, set a value | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2021-11-09 22:23:31 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | 1924203, 1927452 | ||||||||||||
| Bug Blocks: | 1921681 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Michael Kaplan
2021-01-28 12:14:02 UTC
Created attachment 1752147 [details] CVE-2020-10001.report.txt Created attachment 1752148 [details]
2763-update-to-61415567-to-use-the-correct-calcu.patch
Created attachment 1752155 [details]
2756-validate-input-lengths-for-IPP_TAG_-TEXT-NA.patch
Created attachment 1752759 [details]
Full patch from OpenPrinting
The updated patch by Mike Sweet from OpenPrinting. The Apple patches are incomplete.
From CVE-2020-10001.report.txt: - Steps to reproduce the vulnerability (including sample code if appropriate). 1. push ipp.c attached(just add some log) to external/libcups/cups/ and compile testipp command according to Android.mk attached, then push it to phone, run command as below(poc.ipp attached): # CUPS_DEBUG_LOG="-" CUPS_DEBUG_LEVEL=2 ./testipp poc.ipp We are missing the adjusted ipp.c and the poc.ipp for reproducing the issue. I'll ping Deven for those files. Created cups tracking bugs for this issue: Affects: fedora-all [bug 1924203] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4393 https://access.redhat.com/errata/RHSA-2021:4393 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10001 |