CVE-2025-58060

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
GitHub_MCNA
8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
VendorProductVersion
openprintingcups
𝑥
< 2.4.13
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cups
bullseye
vulnerable
bullseye (security)
2.3.3op2-3+deb11u10
fixed
bookworm
vulnerable
bookworm (security)
2.4.2-3+deb12u9
fixed
trixie
vulnerable
trixie (security)
2.4.10-3+deb13u1
fixed
forky
2.4.14-1
fixed
sid
2.4.14-1
fixed
Common Weakness Enumeration
References
https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221
https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq