Command injection in cups-filters
Priority MEDIUM 44CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime.
Why it matters now
EPSS 0.03697 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 7 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenPrinting | cups-filters | up to 2.0rc1 | — | No fix listed | CNA |
- cups-filters VendorOpenPrinting Affected up to 2.0rc1 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:cups-filters:*:*:*:*:*:*:*:* | before 2.0 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta1:*:*:*:*:*:* | 2.0 beta1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta2:*:*:*:*:*:* | 2.0 beta2 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta3:*:*:*:*:*:* | 2.0 beta3 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:cups-filters:2.0:rc1:*:*:*:*:*:* | 2.0 rc1 | Vulnerable | backstage |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:linuxfoundation:cups-filters:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta1:*:*:*:*:*:* Versions 2.0 beta1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta2:*:*:*:*:*:* Versions 2.0 beta2 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:cups-filters:2.0:beta3:*:*:*:*:*:* Versions 2.0 beta3 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:cups-filters:2.0:rc1:*:*:*:*:*:* Versions 2.0 rc1 Vulnerable ·backstage
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
Red Hat 7 advisories
- RHSA-2023:3426 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) cups-filters-devel-1.20.0-27.el8_6.1
- Red Hat Enterprise Linux AppStream EUS (v.8.6) cups-filters-1.20.0-27.el8_6.1, cups-filters-libs-1.20.0-27.el8_6.1
- RHSA-2023:3429 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) cups-filters-1.20.0-18.el8_1.1, cups-filters-libs-1.20.0-18.el8_1.1
- RHSA-2023:3423 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat Enterprise Linux AppStream (v. 9) cups-filters-1.28.7-11.el9_2.1, cups-filters-libs-1.28.7-11.el9_2.1
- Red Hat Enterprise Linux CRB (v. 9) cups-filters-devel-1.28.7-11.el9_2.1
Show 4 more Red Hat advisories
- RHSA-2023:3428 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) cups-filters-1.20.0-19.el8_2.1, cups-filters-libs-1.20.0-19.el8_2.1
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) cups-filters-1.20.0-19.el8_2.1, cups-filters-libs-1.20.0-19.el8_2.1
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) cups-filters-1.20.0-19.el8_2.1, cups-filters-libs-1.20.0-19.el8_2.1
- RHSA-2023:3425 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat Enterprise Linux AppStream (v. 8) cups-filters-1.20.0-29.el8_8.2, cups-filters-libs-1.20.0-29.el8_8.2
- Red Hat Enterprise Linux CRB (v. 8) cups-filters-devel-1.20.0-29.el8_8.2
- RHSA-2023:3427 Released 2023-06-05 · Red Hat rating Importantcups-filters security update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) cups-filters-1.20.0-24.el8_4.1, cups-filters-libs-1.20.0-24.el8_4.1
- Red Hat Enterprise Linux CRB EUS (v.8.4) cups-filters-devel-1.20.0-24.el8_4.1
- RHSA-2023:3424 Released 2023-06-04 · Red Hat rating Importantcups-filters security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) cups-filters-devel-1.28.7-10.el9_0.1
- Red Hat Enterprise Linux AppStream EUS (v.9.0) cups-filters-1.28.7-10.el9_0.1, cups-filters-libs-1.28.7-10.el9_0.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2023:3426 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:3424 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:3425 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:3423 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:3428 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2023:3429 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:3428 |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | RHSA-2023:3427 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:3426 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:3424 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:3428 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:3425 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:3423 |
| Red Hat Enterprise Linux CRB EUS (v.8.4) | Fixed | RHSA-2023:3427 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24805
References
Advisory 2
More OpenPrinting vulnerabilities
- TI-2023-16941 cpdb-libs vulnerable to buffer overflows via scanf CVSS 3.1CRITICAL 9.8
- TI-2024-31543 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer CVSS 3.1CRITICAL 9.8
- TI-2024-31458 libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server CVSS 3.1HIGH 8.6
- TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
- TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
- TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-24805 · CVE Program
- CVE-2023-24805 · NVD
- FIRST EPSS
- CVE-2023-24805 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences