| Name | CVE-2018-4300 |
| Description | The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
| References | DLA-1936-1 |
| NVD severity | medium |
| Debian Bugs | 915909 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| cups (PTS) | jessie | 1.7.5-11+deb8u2 | vulnerable |
| jessie (security) | 1.7.5-11+deb8u7 | fixed | |
| stretch | 2.2.1-8+deb9u5 | fixed | |
| stretch (security) | 2.2.1-8+deb9u2 | vulnerable | |
| buster | 2.2.10-6+deb10u3 | fixed | |
| bullseye, sid | 2.3.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| cups | source | (unstable) | 2.2.10-1 | 915909 | ||
| cups | source | jessie | 1.7.5-11+deb8u6 | DLA-1936-1 | ||
| cups | source | stretch | 2.2.1-8+deb9u3 |
https://github.com/apple/cups/commit/feb4c62b211bfbd78dc10d737d873439ccdfa58c (2.2.10)
https://github.com/apple/cups/commit/b9ff93ce913ff633a3f667317e5a81fa7fe0d5d3 (2.3b6)
Clarification about typo for CVE id: https://github.com/apple/cups/issues/5561