Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cups for openSUSE:Factory checked in at 2026-10-20 12:36:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cups (Old) and /work/SRC/openSUSE:Factory/.cups.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cups" Tue Oct 20 12:36:07 2026 rev:187 rq:1386176 version:2.4.20 Changes: -------- --- /work/SRC/openSUSE:Factory/cups/cups.changes 2026-09-30 16:23:00.286231516 +0200 +++ /work/SRC/openSUSE:Factory/.cups.new.3698736/cups.changes 2026-10-20 12:36:21.946613136 +0200 @@ -1,0 +2,76 @@ +Wed Oct 14 11:08:33 UTC 2026 - Johannes Meixner <[email protected]> + +- fix_mailto_validation.patch is + "Fix: mailto notifier rejects valid email addresses + containing dots" + https://github.com/OpenPrinting/cups/pull/1745 + "Regression: mailto notifier rejects valid email addresses + containing dots/periods" + https://github.com/OpenPrinting/cups/issues/1744 + +------------------------------------------------------------------- +Tue Oct 6 12:29:07 UTC 2026 - Johannes Meixner <[email protected]> + +- Version upgrade to 2.4.20: + See https://github.com/openprinting/cups/releases + CUPS 2.4.20 provides amount of bug fixes and security fixes: + Assigned CVE ids: + CVE-2025-55480 (bsc#1284277) + CVE-2026-61702 (bsc#1284278) + CVE-2026-87875 (bsc#1279945) + CVE-2026-87876 (bsc#1279944) + CVE-2026-55453 (bsc#1284275) + CVE-2026-55467 (bsc#1284276) + CVE-2026-105326 (bsc#1284274) + Several fixes use GHSA id of security advisory + due long waiting time for CVE ids from CNA. + Due our changed policy the fixes referencing GHSA id are for: + * vulnerabilities with CVSS < 7.0, which we take + as lower priority vulnerabilities, + * issues which require print admin rights for triggering them, + * issues where its fix is security hardening patch/feature. + Per our security policy, issues which require print admin rights, + or are security hardening patches, are not taken as vulnerability + and they reference a security advisory due convenience, see + https://github.com/OpenPrinting/cups?tab=security-ov-file + More details in CHANGES.md - excerpts: + * SECURITY-5.7: The scheduler did not open temporary PPD files + in exclusive mode (CVE-2026-55480) + * SECURITY-5.5: The scheduler did not remove all job status + attributes from a job creation request (GHSA-7j85-5r23-xhvh) + * SECURITY-5.3: The scheduler did not validate the request + language value (CVE-2026-61702) + * SECURITY-4.6: Attribute names were not validated + as proper keyword values (GHSA-w9hj-hq9p-m7f6) + * SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly + treated UTF-32 values as 64-bit (CVE-2026-87875) + * SECURITY-4.1: Held jobs for temporary print queues could + crash the scheduler (GHSA-qqm8-4q5h-jg55) + * SECURITY-3.3: The backend did not sanitize IPP attribute + strings (CVE-2026-55453) + * SECURITY-3.3: The scheduler did not filter out group separators + from job submissions (GHSA-wjc4-qhjr-5m5x) + * SECURITY-3.0: Quota and policy operations did not treat + usernames as case-sensitive (CVE-2026-87876) + * SECURITY-3.0: The scheduler's startup permission checks + were vulnerable to TOU attacks (GHSA-gj33-wxpv-6fgg) + * SECURITY-2.5: The scheduler did not sanitize + fax numbers (CVE-2026-55467) + * SECURITY-2.5: The 'mailto' notifier did not sanitize + the recipient address provided to the sendmail + command (CVE-2026-105326) + * SECURITY-2.3: The scheduler could crash when modifying + a class (GHSA-pwg4-pv39-8c22) + * Fixed handling of multiple PPD: keywords from filters + (Issue #1562, related to CVE-2026-34980) + Issues are those at https://github.com/OpenPrinting/cups/issues +- Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20 +- cups-2.4.19-CVE-2026-87875.patch + is no longer needed because the issue is fixed upstream. +- avoid_C99_loop_initial_declarations.patch avoids + "ppd-cache.c:2173:5: error: 'for' loop initial declarations + are only allowed in C99 mode" + which happens when building CUPS 2.4.20 on older SLE12 + https://github.com/OpenPrinting/cups/issues/1742 + +------------------------------------------------------------------- Old: ---- cups-2.4.19-CVE-2026-87875.patch cups-2.4.19-source.tar.gz cups-2.4.19-source.tar.gz.sig New: ---- avoid_C99_loop_initial_declarations.patch cups-2.4.20-source.tar.gz cups-2.4.20-source.tar.gz.sig fix_mailto_validation.patch ----------(Old B)---------- Old:- Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.20 - cups-2.4.19-CVE-2026-87875.patch is no longer needed because the issue is fixed upstream. ----------(Old E)---------- ----------(New B)---------- New: is no longer needed because the issue is fixed upstream. - avoid_C99_loop_initial_declarations.patch avoids "ppd-cache.c:2173:5: error: 'for' loop initial declarations New: - fix_mailto_validation.patch is "Fix: mailto notifier rejects valid email addresses ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cups.spec ++++++ --- /var/tmp/diff_new_pack.8eE1pz/_old 2026-10-20 12:36:24.539721241 +0200 +++ /var/tmp/diff_new_pack.8eE1pz/_new 2026-10-20 12:36:24.541721325 +0200 @@ -40,18 +40,18 @@ # "zypper vcmp 2.3.b99 2.3.0" shows "2.3.b99 is older than 2.3.0" and # "zypper vcmp 2.2.99 2.3b6" show "2.2.99 is older than 2.3b6" so that # version upgrades from 2.2.x via 2.3.b* to 2.3.0 work: -Version: 2.4.19 +Version: 2.4.20 Release: 0 Summary: The Common UNIX Printing System License: Apache-2.0 Group: Hardware/Printing URL: https://openprinting.github.io/cups # To get Source0 go to https://github.com/OpenPrinting/cups/releases or use e.g. -# wget --no-check-certificate -O cups-2.4.19-source.tar.gz https://github.com/OpenPrinting/cups/releases/download/v2.4.19/cups-2.4.19-source.tar.gz -Source0: https://github.com/OpenPrinting/cups/releases/download/v2.4.19/cups-2.4.19-source.tar.gz +# wget --no-check-certificate -O cups-2.4.20-source.tar.gz https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz +Source0: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz # To get Source1 go to https://github.com/OpenPrinting/cups/releases or use e.g. -# wget --no-check-certificate -O cups-2.4.19-source.tar.gz.sig https://github.com/OpenPrinting/cups/releases/download/v2.4.19/cups-2.4.19-source.tar.gz.sig -Source1: https://github.com/OpenPrinting/cups/releases/download/v2.4.19/cups-2.4.19-source.tar.gz.sig +# wget --no-check-certificate -O cups-2.4.20-source.tar.gz.sig https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz.sig +Source1: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz.sig # To make Source2 use for 'Zdenek Dohnal' # gpg --keyserver keys.openpgp.org --recv-keys 7082A0A50A2E92640F3880E0E4522DCC9B246FF7 # gpg --export --armor 7082A0A50A2E92640F3880E0E4522DCC9B246FF7 >cups.keyring @@ -65,7 +65,7 @@ # To manually verify Source0 with Source1 and Source2 do e.g. # gpg --import cups.keyring # gpg --list-keys | grep -1 'Zdenek Dohnal' -# gpg --verify cups-2.4.19-source.tar.gz.sig cups-2.4.19-source.tar.gz +# gpg --verify cups-2.4.20-source.tar.gz.sig cups-2.4.20-source.tar.gz Source102: Postscript.ppd.gz Source105: Postscript-level1.ppd.gz Source106: Postscript-level2.ppd.gz @@ -93,6 +93,16 @@ Patch103: cups-1.4-do_not_strip_recommended_from_PPDs.patch # Patch104 cups-config-libs.patch fixes option --libs in cups-config script: Patch104: cups-config-libs.patch +# Patch105 avoid_C99_loop_initial_declarations.patch avoids +# "ppd-cache.c:2173:5: error: 'for' loop initial declarations are only allowed in C99 mode" +# which happens when building CUPS 2.4.20 on older SLE12: +Patch105: avoid_C99_loop_initial_declarations.patch +# Patch106 fix_mailto_validation.patch is +# "Fix: mailto notifier rejects valid email addresses containing dots" +# https://github.com/OpenPrinting/cups/pull/1745 +# "Regression: mailto notifier rejects valid email addresses containing dots/periods" +# https://github.com/OpenPrinting/cups/issues/1744 +Patch106: fix_mailto_validation.patch # Patch107 harden_cups.service.patch adds hardening to systemd service cups.service # see https://bugzilla.suse.com/show_bug.cgi?id=1181400 # and https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort @@ -107,16 +117,6 @@ # Patch112 cups-2.4.2-additional_policies.patch adds the 'allowallforanybody' policy to cupsd.conf # see SUSE FATE 303515 and https://bugzilla.suse.com/show_bug.cgi?id=936309 Patch112: cups-2.4.2-additional_policies.patch -# Patch113 cups-2.4.19-CVE-2026-87875.patch is based on -# https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 -# adapted to CUPS 2.4.19 to fix CVE-2026-87875 -# "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound -# - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" -# https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq -# "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound -# can be reached via the SNMP supply-description parsing" -# https://bugzilla.suse.com/show_bug.cgi?id=1279945 -Patch113: cups-2.4.19-CVE-2026-87875.patch # Build Requirements: BuildRequires: dbus-1-devel BuildRequires: fdupes @@ -331,6 +331,16 @@ %patch -P 103 -b do_not_strip_recommended_from_PPDs.orig # Patch104 cups-config-libs.patch fixes option --libs in cups-config script: %patch -P 104 -b cups-config-libs.orig +# Patch105 avoid_C99_loop_initial_declarations.patch avoids +# "ppd-cache.c:2173:5: error: 'for' loop initial declarations are only allowed in C99 mode" +# which happens when building CUPS 2.4.20 on older SLE12: +%patch -P 105 -b avoid_C99_loop_initial_declarations.orig +# Patch106 fix_mailto_validation.patch is +# "Fix: mailto notifier rejects valid email addresses containing dots" +# https://github.com/OpenPrinting/cups/pull/1745 +# "Regression: mailto notifier rejects valid email addresses containing dots/periods" +# https://github.com/OpenPrinting/cups/issues/1744 +%patch -P 106 -b fix_mailto_validation.orig # Patch107 harden_cups.service.patch adds hardening to systemd service cups.service # see https://bugzilla.suse.com/show_bug.cgi?id=1181400 # and https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort @@ -344,16 +354,6 @@ # Patch112 cups-2.4.2-additional_policies.patch adds the 'allowallforanybody' policy to cupsd.conf # see SUSE FATE 303515 and https://bugzilla.suse.com/show_bug.cgi?id=936309 %patch -P 112 -b additional_policies.orig -# Patch113 cups-2.4.19-CVE-2026-87875.patch is based on -# https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4 -# adapted to CUPS 2.4.19 to fix CVE-2026-87875 -# "Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound -# - reachable from SNMP supply-description parsing (backend/snmp-supplies.c)" -# https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq -# "heap out-of-bounds read in `cupsUTF32ToUTF8()` due to missing source-length bound -# can be reached via the SNMP supply-description parsing" -# https://bugzilla.suse.com/show_bug.cgi?id=1279945 -%patch -P113 -b CVE-2026-87875.orig %build # Remove ".SILENT" rule for verbose build output ++++++ avoid_C99_loop_initial_declarations.patch ++++++ --- cups/ppd-cache.c.orig 2026-10-05 17:26:07.000000000 +0200 +++ cups/ppd-cache.c 2026-10-06 12:19:37.620476541 +0200 @@ -2083,6 +2083,7 @@ void _ppdCacheDestroy(_ppd_cache_t *pc) /* I - PPD cache and mapping data */ { int i; /* Looping var */ + int j; /* Inner looping var */ pwg_map_t *map; /* Current map */ pwg_size_t *size; /* Current size */ @@ -2170,7 +2171,7 @@ _ppdCacheDestroy(_ppd_cache_t *pc) /* I for (i = _PWG_PRINT_COLOR_MODE_MONOCHROME; i < _PWG_PRINT_COLOR_MODE_MAX; i ++) - for (int j = _PWG_PRINT_QUALITY_DRAFT; j < _PWG_PRINT_QUALITY_MAX; j ++) + for (j = _PWG_PRINT_QUALITY_DRAFT; j < _PWG_PRINT_QUALITY_MAX; j ++) if (pc->num_presets[i][j]) cupsFreeOptions(pc->num_presets[i][j], pc->presets[i][j]); ++++++ cups-2.4.19-source.tar.gz -> cups-2.4.20-source.tar.gz ++++++ /work/SRC/openSUSE:Factory/cups/cups-2.4.19-source.tar.gz /work/SRC/openSUSE:Factory/.cups.new.3698736/cups-2.4.20-source.tar.gz differ: char 4, line 1 ++++++ downgrade-autoconf-requirement.patch ++++++ --- /var/tmp/diff_new_pack.8eE1pz/_old 2026-10-20 12:36:24.698727870 +0200 +++ /var/tmp/diff_new_pack.8eE1pz/_new 2026-10-20 12:36:24.701727995 +0200 @@ -10,5 +10,5 @@ +AC_PREREQ([2.69]) dnl Package name and version... - AC_INIT([CUPS],[2.4.19],[https://github.com/openprinting/cups/issues],[cups],[https://openprinting.github.io/cups]) + AC_INIT([CUPS],[2.4.20],[https://github.com/openprinting/cups/issues],[cups],[https://openprinting.github.io/cups]) ++++++ fix_mailto_validation.patch ++++++ --- notifier/mailto.c.orig 2026-10-05 17:26:07.000000000 +0200 +++ notifier/mailto.c 2026-10-14 13:01:43.536132354 +0200 @@ -262,13 +262,14 @@ copy_validate_address( saw_at = 1; } - else if (*bufptr == '.' && (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@')) + else if (*bufptr == '.') { /* * dot-atom-text doesn't allow consecutive periods... */ - goto bad_address; + if (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@') + goto bad_address; } else if (!strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" "0123456789!#$%&\'*+-/=?^_`{|}~", *bufptr))
