Re: CUPS 2.4.11 is released!

Hi all,

since the fixes in CUPS were not handled as CVEs, I've stayed with the 
current handling.

In any way, it is always advised to upgrade to the latest packages if it 
is possible.

If anyone is looking for CVE-related fixes, those are the commits:

https://github.com/OpenPrinting/cups/commit/9939a70b750edd9d05270060cc5cf62ca98cfbe5

https://github.com/OpenPrinting/cups/commit/04bb2af4521b56c1699a2c2431c56c05a7102e69

https://github.com/OpenPrinting/cups/commit/e0630cd18f76340d302000f2bf6516e99602b844

https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd

https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b


Zdenek

On 9/30/24 16:55, Johannes Meixner wrote:
>
> Hello,
>
> On 2024-09-30 16:42, Till Kamppeter wrote:
>> thanks for the quick release, but the CHANGES.md
>> does not mention the CVE-related fixes contained in it.
>
>> On 9/30/24 14:25, Zdenek Dohnal wrote:
>>> CUPS 2.4.11 brings several bug fixes
>>> regarding IPP response validation, processing PPD values,
>>> Web UI support (checkbox support, modifying printers)
>>> and others fixes.
>
> I was also wondering about CVE-related fixes.
> As far as I understand it from the GitHub upstream commits
> CUPS 2.4.11 contains (only) those commits regarding
> IPP response validation and processing PPD values
>
> "Quote PPD localized strings"
> https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd 
>
>
> plus the cleanup to "Fix warnings for unused vars"
> https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b 
>
>
> which are somewhat related to those CVEs
> by avoiding sililar further issues as in those CVEs
> but are not the actual fixes for explicitly those CVEs.
>
>
> Kind Regards
> Johannes Meixner

-- 
Zdenek Dohnal
Senior Software Engineer
Red Hat, BRQ-TPBC