cups has Authentication bypass with AuthType Negotiate
Summary
cups has Authentication bypass with AuthType Negotiate
Original description
The description as published by the source.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2025-58060 cups Fixed in: 2.4.16-r0
- Debian DEBIAN-CVE-2025-58060 cups Fixed in: 2.3.3op2-3+deb11u10
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web openwall.com
- web lists.debian.org