CyberRota Analysis
AI-GeneratedOpenPrinting CUPS versions prior to 2.4.20 are vulnerable to a NULL pointer dereference due to improper handling of repeated IPP group tags in job-creation requests, which can lead to a crash of the cupsd service. This vulnerability can be exploited by sending a specially crafted Print-Job request, potentially disrupting all print queues if the attacker has access to submit jobs. Organizations using CUPS with enabled job submission should prioritize patching to mitigate this risk, especially if anonymous job submissions are allowed.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.