Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cups-filters for openSUSE:Factory checked in at 2026-10-09 21:42:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cups-filters (Old) and /work/SRC/openSUSE:Factory/.cups-filters.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cups-filters" Fri Oct 9 21:42:47 2026 rev:65 rq:1383292 version:1.28.17 Changes: -------- --- /work/SRC/openSUSE:Factory/cups-filters/cups-filters.changes 2026-09-04 12:37:03.907535460 +0200 +++ /work/SRC/openSUSE:Factory/.cups-filters.new.3698736/cups-filters.changes 2026-10-09 21:43:00.287323616 +0200 @@ -1,0 +2,29 @@ +Thu Oct 8 11:41:24 UTC 2026 - Johannes Meixner <[email protected]> + +- No longer provide the serial backend with 0700 permissions + so cupsd does no longer run it as root but as usual + as user 'lp' to avoid CVE-2026-95511 + "Root arbitrary file overwrite via serial ... device-URI path" + https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj + "`lpadmin` user can escalate privileges to `root` via printers + that uses a privileged serial backend" (bsc#1282291) + Note the general security advice in the section + "Allow printer admin tasks for a normal user" in + https://en.opensuse.org/SDB:CUPS_in_a_Nutshell +- No longer provide any other backend with 0700 permissions + so cupsd does no longer run them as root but as usual + as user 'lp' because running something as root by default + is a generic security issue which we avoid now by default + so the user must set less secure permissions manually + only as specifically needed. In particular longer provide + /usr/lib/cups/backend/beh + /usr/lib/cups/backend/cups-brf + /usr/lib/cups/backend/implicitclass + with 0700 permissions by default so in particular + https://bugzilla.opensuse.org/show_bug.cgi?id=1178604 + re-appears but security by default is mandatory nowadays, + cf. the sections "Security: Make Things Not Just Work" + and "Automated print queue setup via cups-browsed" in + https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cups-filters.spec ++++++ --- /var/tmp/diff_new_pack.fKEOXo/_old 2026-10-09 21:43:01.524375462 +0200 +++ /var/tmp/diff_new_pack.fKEOXo/_new 2026-10-09 21:43:01.530375713 +0200 @@ -446,25 +446,54 @@ /usr/lib/cups/driver/driverless /usr/lib/cups/driver/driverless-fax %dir /usr/lib/cups/backend -# The wrapper backends beh and implicitclass must be installed with 0700 permissions -# so that cupsd runs them as root (backends with root-only permissions are run as root by cupsd) -# because otherwise wrapper backends cannot run other backends that need to run as root -# in particular the ipp backend runs as root and the implicitclass wrapper backend runs it -# to print via queues that are generated by cupsd-browsed, +# The wrapper backend beh would need 0700 permissions so that cupsd runs it as root +# (backends with root-only permissions are run as root by cupsd) +# because otherwise wrapper backends cannot run other backends that need to run as root. +# In particular the ipp backend runs as root so that it can support Kerberos authentication # see https://github.com/OpenPrinting/cups-filters/issues/183#issuecomment-570196216 -# and https://bugzilla.opensuse.org/show_bug.cgi?id=1178604 -%attr(0700,root,root) /usr/lib/cups/backend/beh -%attr(0700,root,root) /usr/lib/cups/backend/implicitclass +# so when beh should be used for the ipp backend beh needs 0700 permissions to run as root. +# But running something as root in any case is a generic security issue +# which we avoid by not setting 0700 permissions for beh in any case here +# so the user must set such permissions manually only when really needed. +# See also https://bugzilla.opensuse.org/show_bug.cgi?id=1178604 +# which was about as similar case where the implicitclass wrapper backend +# runs the ipp backend to print via queues that are generated by cupsd-browsed +# but cupsd-browsed is a generic security issue because +# automated driverless printer setup requires IPP communication with the printer +# for polling capability information from the printer to generate a PPD file +# from what the printer responds to set up a print queue with that PPD file. +# Automated printer setup from what a (possibly fake) printer responds +# is a generic security issue: You must trust the printer because +# the printer's response controlls what print queue gets set up. +# Cf. https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings +%attr(0755,root,root) /usr/lib/cups/backend/beh +%attr(0755,root,root) /usr/lib/cups/backend/implicitclass # The parallel backend does not need to be run as root because cupsd runs backends by default as user lp group lp # and the parallel port kernel device node /dev/lp0 has by default rw permissions for the group lp %attr(0755,root,root) /usr/lib/cups/backend/parallel -# The cups-brf backend needs to run as root +# The cups-brf backend would need to be run as root # see https://bugzilla.redhat.com/show_bug.cgi?id=1657261 # and https://bugzilla.suse.com/show_bug.cgi?id=1186844 -%attr(0700,root,root) /usr/lib/cups/backend/cups-brf -# Serial backend needs to run as root -# see https://bugzilla.redhat.com/show_bug.cgi?id=212577#c4 -%attr(0700,root,root) /usr/lib/cups/backend/serial +# But running something as root in any case is a generic security issue +# which we avoid by not setting 0700 permissions for the backend +# so the user must set such permissions manually only when really needed. +%attr(0755,root,root) /usr/lib/cups/backend/cups-brf +# The serial backend would need 0700 permissions so that cupsd runs it as root +# to access serial device nodes like /dev/ttyS... or /dev/ttyUSB... +# with their default permissions rw-rw---- +# cf. https://bugzilla.redhat.com/show_bug.cgi?id=212577 +# But running something as root in any case is a generic security issue +# which we avoid by not setting 0700 permissions for the serial backend +# so the user must set such permissions manually only when really needed +# or change the default permissions of the specific device node +# so that the user 'lp' which normally runs backends can access it. +# In particular because a privileged user who has print admin rights +# can set up a print queue with an arbitrary serial backend device URI, +# this privileged user can misuse his privileges to overwrite arbitrary files, see +# https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-m74w-wg6q-vvpj +# and note the general security advice in +# https://en.opensuse.org/SDB:CUPS_in_a_Nutshell#Allow_printer_admin_tasks_for_a_normal_user +%attr(0755,root,root) /usr/lib/cups/backend/serial # Explicit attr() mode not applicable to symlink /usr/lib/cups/backend/driverless /usr/lib/cups/backend/driverless /usr/lib/cups/backend/driverless-fax
