CVE-2024-47850
Publication date 4 October 2024
Last updated 9 October 2024
Ubuntu priority
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cups-browsed | 24.04 LTS noble |
Fixed 2.0.0-0ubuntu10.1
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| cups-filters | 24.04 LTS noble |
Not affected
|
| 22.04 LTS jammy |
Fixed 1.28.15-0ubuntu1.3
|
|
| 20.04 LTS focal |
Fixed 1.27.4-1ubuntu0.3
|
|
| 18.04 LTS bionic |
Fixed 1.20.2-0ubuntu3.3+esm1
|
|
| 16.04 LTS xenial |
Fixed 1.8.3-2ubuntu3.5+esm2
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-47850
- https://www.akamai.com/blog/security-research/october-cups-ddos-threat
- https://www.openwall.com/lists/oss-security/2024/10/04/1
- https://github.com/advisories/GHSA-phc2-g348-384g
- https://github.com/OpenPrinting/cups
- https://myasnchisdf.eu.org/blog/cups-remote-code-execution-vulnerability-fix-available