Bug 1921680 (CVE-2020-10001) - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c
Summary: CVE-2020-10001 cups: access to uninitialized buffer in ipp.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10001
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1924203 1927452
Blocks: 1921681
TreeView+ depends on / blocked
 
Reported: 2021-01-28 12:14 UTC by Michael Kaplan
Modified: 2021-11-09 22:23 UTC (History)
3 users (show)

Fixed In Version: cups 2.3.3op2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-09 22:23:31 UTC
Embargoed:

Attachments (Terms of Use)
CVE-2020-10001.report.txt (3.88 KB, text/plain)
2021-01-29 21:43 UTC, msiddiqu 		no flags Details
2763-update-to-61415567-to-use-the-correct-calcu.patch (1.18 KB, application/octet-stream)
2021-01-29 21:44 UTC, msiddiqu 		no flags Details
2756-validate-input-lengths-for-IPP_TAG_-TEXT-NA.patch (1.85 KB, application/octet-stream)
2021-01-29 21:45 UTC, msiddiqu 		no flags Details
Full patch from OpenPrinting (2.37 KB, patch)
2021-02-01 05:56 UTC, Zdenek Dohnal 		no flags Details | Diff
Show Obsolete (2) View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4393 0 None None None 2021-11-09 18:35:01 UTC

Description Michael Kaplan 2021-01-28 12:14:02 UTC 
An vulnerability was found in cups.
Comment 1 msiddiqu 2021-01-29 21:43:44 UTC 
Created attachment 1752147 [details]
CVE-2020-10001.report.txt
Comment 2 msiddiqu 2021-01-29 21:44:25 UTC 
Created attachment 1752148 [details]
2763-update-to-61415567-to-use-the-correct-calcu.patch
Comment 3 msiddiqu 2021-01-29 21:45:12 UTC 
Created attachment 1752155 [details]
2756-validate-input-lengths-for-IPP_TAG_-TEXT-NA.patch
Comment 4 Zdenek Dohnal 2021-02-01 05:56:52 UTC 
Created attachment 1752759 [details]
Full patch from OpenPrinting

The updated patch by Mike Sweet from OpenPrinting. The Apple patches are incomplete.
Comment 5 Zdenek Dohnal 2021-02-01 06:01:07 UTC 
From CVE-2020-10001.report.txt:

- Steps to reproduce the vulnerability (including sample code if
appropriate).
1. push ipp.c attached(just add some log) to external/libcups/cups/ and compile testipp command according to Android.mk attached, then push it to phone, run command as below(poc.ipp attached):
# CUPS_DEBUG_LOG="-" CUPS_DEBUG_LEVEL=2 ./testipp poc.ipp

We are missing the adjusted ipp.c and the poc.ipp for reproducing the issue. I'll ping Deven for those files.
Comment 6 Guilherme de Almeida Suckevicz 2021-02-02 18:56:03 UTC 
Created cups tracking bugs for this issue:

Affects: fedora-all [bug 1924203]
Comment 8 errata-xmlrpc 2021-11-09 18:35:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4393 https://access.redhat.com/errata/RHSA-2021:4393
Comment 9 Product Security DevOps Team 2021-11-09 22:23:29 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10001
Note You need to log in before you can comment on or make changes to this bug.