Read the docs
TI-2024-32111 Aliases CVE-2024-47850GHSA-phc2-g348-384g

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination…

Priority HIGH 66CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00853 58th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:cups:cups:1.0:-:*:*:*:*:*:*1.0—cups
  • cpe:2.3:a:cups:cups:1.0:-:*:*:*:*:*:* Versions 1.0 — ·cups

Remediation

Red Hat 10 advisories

  • RHSA-2024:7623 Released 2024-10-03 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) cups-filters-1.20.0-27.el8_6.3, cups-filters-libs-1.20.0-27.el8_6.3
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) cups-filters-1.20.0-27.el8_6.3, cups-filters-libs-1.20.0-27.el8_6.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) cups-filters-1.20.0-27.el8_6.3, cups-filters-libs-1.20.0-27.el8_6.3
  • RHSA-2024:7553 Released 2024-10-02 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) cups-filters-1.0.35-29.el7_9.3, cups-filters-libs-1.0.35-29.el7_9.3, cups-filters-libs-1.0.35-29.el7_9.3.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) cups-filters-devel-1.0.35-29.el7_9.3, cups-filters-devel-1.0.35-29.el7_9.3.ppc
  • RHSA-2024:7551 Released 2024-10-02 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux Server AUS (v. 7.7) cups-filters-1.0.35-26.el7_7.3, cups-filters-libs-1.0.35-26.el7_7.3
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) cups-filters-devel-1.0.35-26.el7_7.3
Show 7 more Red Hat advisories
  • RHSA-2024:7503 Released 2024-10-02 · Red Hat rating Important
    cups-filters security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) cups-filters-devel-1.28.7-11.el9_2.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) cups-filters-1.28.7-11.el9_2.2, cups-filters-libs-1.28.7-11.el9_2.2
  • RHSA-2024:7504 Released 2024-10-02 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) cups-filters-1.20.0-24.el8_4.2, cups-filters-libs-1.20.0-24.el8_4.2
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) cups-filters-1.20.0-24.el8_4.2, cups-filters-libs-1.20.0-24.el8_4.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) cups-filters-1.20.0-24.el8_4.2, cups-filters-libs-1.20.0-24.el8_4.2
  • RHSA-2024:7506 Released 2024-10-02 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) cups-filters-1.28.7-10.el9_0.2, cups-filters-libs-1.28.7-10.el9_0.2
  • RHSA-2024:7463 Released 2024-10-01 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream (v. 8) cups-filters-1.20.0-35.el8_10, cups-filters-libs-1.20.0-35.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) cups-filters-devel-1.20.0-35.el8_10
  • RHSA-2024:7462 Released 2024-10-01 · Red Hat rating Important
    cups-filters security update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) cups-filters-devel-1.20.0-29.el8_8.3
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) cups-filters-1.20.0-29.el8_8.3, cups-filters-libs-1.20.0-29.el8_8.3
  • RHSA-2024:7461 Released 2024-10-01 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) cups-filters-1.20.0-19.el8_2.2, cups-filters-libs-1.20.0-19.el8_2.2
  • RHSA-2024:7346 Released 2024-09-27 · Red Hat rating Important
    cups-filters security update
    • Red Hat Enterprise Linux AppStream (v. 9) cups-filters-1.28.7-17.el9_4, cups-filters-libs-1.28.7-17.el9_4
    • Red Hat Enterprise Linux CRB (v. 9) cups-filters-devel-1.28.7-17.el9_4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:7462
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:7503
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:7463
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:7346
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:7461
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:7504
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:7623
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:7504
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:7623
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:7506
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:7462
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:7503
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:7504
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:7623
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:7463
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:7346
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:7553
Red Hat Enterprise Linux Server AUS (v. 7.7)Fixed RHSA-2024:7551
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2024:7553
Red Hat Enterprise Linux Server Optional AUS (v. 7.7)Fixed RHSA-2024:7551

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47850
  2. 2026-10-03 Alias added: GHSA-phc2-g348-384g

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences