3 files changed, 141 insertions, 0 deletions

diff --git a/meta/recipes-extended/cups/cups.inc b/meta/recipes-extended/cups/cups.inc
index b87f9dee13..cba4406720 100644
--- a/meta/recipes-extended/cups/cups.inc
+++ b/meta/recipes-extended/cups/cups.inc
@@ -25,6 +25,8 @@ SRC_URI = "https://github.com/OpenPrinting/cups/releases/download/v${PV}/cups-${
            file://CVE-2024-47175-3.patch \
            file://CVE-2024-47175-4.patch \
            file://CVE-2024-47175-5.patch \
+           file://CVE-2025-58060.patch \
+           file://CVE-2025-58364.patch \
            "
 
 UPSTREAM_CHECK_URI = "https://github.com/OpenPrinting/cups/releases"
diff --git a/meta/recipes-extended/cups/cups/CVE-2025-58060.patch b/meta/recipes-extended/cups/cups/CVE-2025-58060.patch
new file mode 100644
index 0000000000..0aea12a9ea
--- /dev/null
+++ b/meta/recipes-extended/cups/cups/CVE-2025-58060.patch
@@ -0,0 +1,76 @@
+From 595d691075b1d396d2edfaa0a8fd0873a0a1f221 Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Thu, 11 Sep 2025 14:44:59 +0200
+Subject: [PATCH] cupsd: Block authentication using alternate method
+
+Fixes: CVE-2025-58060
+
+Upstream-Status: Backport [import from debian 2.4.2-3+deb12u9
+Upstream commit https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221]
+CVE: CVE-2025-58060
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ scheduler/auth.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/scheduler/auth.c b/scheduler/auth.c
+index aa773f9..55f8912 100644
+--- a/scheduler/auth.c
++++ b/scheduler/auth.c
+@@ -513,6 +513,16 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
+     int        userlen;                        /* Username:password length */
+ 
+ 
++    /*
++     * Only allow Basic if enabled...
++     */
++
++    if (type != CUPSD_AUTH_BASIC)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Basic authentication is not enabled.");
++      return;
++    }
++
+     authorization += 5;
+     while (isspace(*authorization & 255))
+       authorization ++;
+@@ -558,10 +568,6 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
+     * Validate the username and password...
+     */
+ 
+-    switch (type)
+-    {
+-      default :
+-      case CUPSD_AUTH_BASIC :
+           {
+ #if HAVE_LIBPAM
+           /*
+@@ -715,8 +721,6 @@ cupsdAuthorize(cupsd_client_t *con) /* I - Client connection */
+           }
+ 
+          cupsdLogClient(con, CUPSD_LOG_DEBUG, "Authorized as \"%s\" using Basic.", username);
+-          break;
+-    }
+ 
+     con->type = type;
+   }
+@@ -733,6 +737,16 @@ cupsdAuthorize(cupsd_client_t *con)        /* I - Client connection */
+                                        /* Output token for username */
+     gss_name_t         client_name;    /* Client name */
+ 
++   /*
++    * Only allow Kerberos if enabled...
++    */
++
++    if (type != CUPSD_AUTH_NEGOTIATE)
++    {
++      cupsdLogClient(con, CUPSD_LOG_ERROR, "Kerberos authentication is not enabled.");
++      return;
++    }
++
+ #  ifdef __APPLE__
+    /*
+     * If the weak-linked GSSAPI/Kerberos library is not present, don't try
+-- 
+2.25.1
+
diff --git a/meta/recipes-extended/cups/cups/CVE-2025-58364.patch b/meta/recipes-extended/cups/cups/CVE-2025-58364.patch
new file mode 100644
index 0000000000..89c6f7bcb3
--- /dev/null
+++ b/meta/recipes-extended/cups/cups/CVE-2025-58364.patch
@@ -0,0 +1,63 @@
+From e58cba9d6fceed4242980e51dbd1302cf638ab1d Mon Sep 17 00:00:00 2001
+From: Zdenek Dohnal <zdohnal@redhat.com>
+Date: Thu, 11 Sep 2025 14:53:49 +0200
+Subject: [PATCH] libcups: Fix handling of extension tag in `ipp_read_io()`
+
+Fixes: CVE-2025-58364
+
+Upstream-Status: Backport [import from debian 2.4.2-3+deb12u9
+Upstream commit https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d]
+CVE: CVE-2025-58364
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ cups/ipp.c | 27 +--------------------------
+ 1 file changed, 1 insertion(+), 26 deletions(-)
+
+diff --git a/cups/ipp.c b/cups/ipp.c
+index 42cf2fc..4b9dc4e 100644
+--- a/cups/ipp.c
++++ b/cups/ipp.c
+@@ -2949,32 +2949,6 @@ ippReadIO(void       *src,               /* I - Data source */
+          */
+ 
+           tag = (ipp_tag_t)buffer[0];
+-          if (tag == IPP_TAG_EXTENSION)
+-          {
+-           /*
+-            * Read 32-bit "extension" tag...
+-            */
+-
+-           if ((*cb)(src, buffer, 4) < 4)
+-           {
+-             DEBUG_puts("1ippReadIO: Callback returned EOF/error");
+-             goto rollback;
+-           }
+-
+-           tag = (ipp_tag_t)((((((buffer[0] << 8) | buffer[1]) << 8) |
+-                               buffer[2]) << 8) | buffer[3]);
+-
+-            if (tag & IPP_TAG_CUPS_CONST)
+-            {
+-             /*
+-              * Fail if the high bit is set in the tag...
+-              */
+-
+-             _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
+-             DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
+-             goto rollback;
+-            }
+-          }
+ 
+          if (tag == IPP_TAG_END)
+          {
+@@ -3323,6 +3297,7 @@ ippReadIO(void       *src,                /* I - Data source */
+                {
+                  if ((*cb)(src, buffer, (size_t)n) < n)
+                  {
++                    _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
+                    DEBUG_puts("1ippReadIO: unable to read string value.");
+                    goto rollback;
+                  }
+-- 
+2.25.1
+