cups: ownership of /var/log/cups allows the lp user to create files as root
Priority LOW 16CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Partial SUSE Linux Enterprise Server 11-SP4-LTSS (SUSE): 1.3.9SUSE Manager Server 4.0 (SUSE): 2.2.7+2 more productsRed Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server 11-SP4-LTSS | cups to before 1.3.9 | 1.3.9 | Patch available | CNA |
| SUSE | SUSE Manager Server 4.0 | cups to before 2.2.7 | 2.2.7 | Patch available | CNA |
| SUSE | SUSE OpenStack Cloud Crowbar 9 | cups to before 1.7.5 | 1.7.5 | Patch available | CNA |
| openSUSE | openSUSE Leap 15.2 | cups to before 2.2.7 | 2.2.7 | Patch available | CNA |
| openSUSE | Factory | cups – 2.3.3op2-2.1 | — | No fix listed | CNA |
- SUSE Linux Enterprise Server 11-SP4-LTSS VendorSUSE Affected cups to before 1.3.9 Fixed in 1.3.9 Patch available CNA
- SUSE Manager Server 4.0 VendorSUSE Affected cups to before 2.2.7 Fixed in 2.2.7 Patch available CNA
- SUSE OpenStack Cloud Crowbar 9 VendorSUSE Affected cups to before 1.7.5 Fixed in 1.7.5 Patch available CNA
- openSUSE Leap 15.2 VendoropenSUSE Affected cups to before 2.2.7 Fixed in 2.2.7 Patch available CNA
- Factory VendoropenSUSE Affected cups – 2.3.3op2-2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* | before 1.3.9 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:* | 11 sp4 | Running on | SUSE |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* | before 2.2.7 | Vulnerable | SUSE |
| cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:* | 4.0 | Running on | SUSE |
| cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* | before 1.7.5 | Vulnerable | SUSE |
| cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:* | 9.0 | Running on | SUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Running on | openSUSE |
- cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* Versions before 1.3.9 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:* Versions 11 sp4 Running on ·SUSE
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* Versions before 2.2.7 Vulnerable ·SUSE
- cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·SUSE
- cpe:2.3:a:suse:cups:*:*:*:*:*:*:*:* Versions before 1.7.5 Vulnerable ·SUSE
- cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·SUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Running on ·openSUSE
Remediation
- Fix · CNA SUSE Linux Enterprise Server 11-SP4-LTSS (SUSE) Fixed in 1.3.9
- Fix · CNA SUSE Manager Server 4.0 (SUSE) Fixed in 2.2.7
- Fix · CNA SUSE OpenStack Cloud Crowbar 9 (SUSE) Fixed in 1.7.5
- Fix · CNA openSUSE Leap 15.2 (openSUSE) Fixed in 2.2.7
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25317
- 2026-10-03 Alias added: GHSA-7qpc-9fjw-5c32
- 2026-10-08 CISA SSVC decision points changed
References
Sources
- CVE-2021-25317 · CVE Program
- CVE-2021-25317 · NVD
- FIRST EPSS
- GHSA-7qpc-9fjw-5c32 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25317 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences