CVE-2022-26691 - log back

CVE-2022-26691 created at 07 Jun 2022 21:22:44
Severity
+ High
Remote
+ Local
Type
+ Authentication bypass
Description
+ CUPS requires users to demonstrate root/admin level access to perform various printer management related functions. Authentication to CUPS is completed by a web interface or over a dedicated file socket. Traditionally, users authenticate via traditional HTTP “Basic” web authorization. However, CUPS also allows authentication via a 32 byte randomly generated hex string. This method of authorization, called “Local” authorization by CUPS, has a bug that allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key. Root/admin access to CUPS yields arbitrary code execution as root with further effort. This affects CUPS 2.x
References
+ https://bugzilla.redhat.com/show_bug.cgi?id=2084321
+ https://lists.debian.org/debian-lts-announce/2022/05/msg00039.html
+ https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0026/MNDT-2022-0026.md
Notes
+ while the advisory on gh only mentions the apple cups release, the openprinting cups also seems affected