Описание
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.
Отчет
This vulnerability is rated Low because exploitation requires multiple environmental conditions beyond the CUPS code flaw alone. The vulnerable mailto notifier logic is present in CUPS packages shipped in Red Hat Enterprise Linux, but practical impact on RHEL is limited: RHEL typically provides Postfix's sendmail-compatible wrapper, which does not support the traditional sendmail -C configuration option used in public proof-of-concept chains, and many systems do not install or enable an MTA for CUPS notifications. By default, cupsd listens only on the local loopback interface unless administrators explicitly configure remote access. Create-Printer-Subscription is allowed for unauthenticated clients only under the default policy when cupsd is configured to accept remote IPP; operators can reduce exposure by restricting network access to the printing service and disabling mail notifications if unused. Red Hat is tracking upstream fixes and will publish updated CUPS packages when available.
Меры по смягчению последствий
Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | cups | Fix deferred | ||
| Red Hat Enterprise Linux 8 | cups | Fix deferred | ||
| Red Hat Enterprise Linux 9 | cups | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rhel9/cups | Fix deferred | ||
| Red Hat Hardened Images | cups-main-2.4.19-4.3.hum1 | Fixed | RHSA-2026:77638 | 07.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
2.5 Low
CVSS3
Связанные уязвимости
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.
Cups: cups: argument injection in mailto notifier via notify-recipient-uri
An argument injection flaw was found in CUPS. When email notification ...
EPSS
2.5 Low
CVSS3