Skip to content
Fencer Vulns
medium 5.3

CVE-2023-34241 json

CUPS vulnerable to use-after-free in cupsdAcceptClient()

published 2023-06-22 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-38329

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process.

The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`.

Version 2.4.6 has a patch for this issue.

Patch / fix

  • openprinting cups 2.4.6
  • apple macos 11.7.9, 12.6.8, 13.5
  • cups Debian 12 2.4.2-3+deb12u1
  • cups Debian 14, Debian 13 2.4.2-5

debian advisories DEBIAN-CVE-2023-34241

  • cups Ubuntu 20.04 LTS 2.3.1-9ubuntu1.4
  • cups Ubuntu 22.04 LTS 2.4.1op1-1ubuntu4.4
  • cups Ubuntu Pro 16.04 LTS 2.1.3-4ubuntu0.11+esm3
  • cups Ubuntu Pro 18.04 LTS 2.2.7-1ubuntu2.10+esm1

ubuntu advisories UBUNTU-CVE-2023-34241

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups RHEL 8 1:2.2.6-54.el8_9
  • cups-lpd RHEL 8 1:2.2.6-54.el8_9
  • cups-libs RHEL 8 1:2.2.6-54.el8_9
  • cups-client RHEL 8 1:2.2.6-54.el8_9
  • cups-ipptool RHEL 8 1:2.2.6-54.el8_9
  • cups-filesystem RHEL 8 1:2.2.6-54.el8_9
  • cups RHEL 9 1:2.3.3op2-21.el9
  • cups-lpd RHEL 9 1:2.3.3op2-21.el9

red hat advisories RHSA-2024:1409RHSA-2024:1101RHSA-2023:7165RHSA-2023:6596

  • cups Linux Micro 6.0 2.4.11-1.1
  • cups SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 1.7.5-20.46.1
  • cups SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +23 more 2.2.7-150000.3.46.1

suse advisories SUSE-SU-2025:20090-1SUSE-SU-2023:3706-1SUSE-SU-2023:2616-1

  • cups openSUSE Tumbleweed 2.4.2-6.1

opensuse advisories openSUSE-SU-2024:13017-1

  • cups AlmaLinux 8 1:2.2.6-54.el8_9
  • cups-lpd AlmaLinux 8 1:2.2.6-54.el8_9
  • cups-libs AlmaLinux 8 1:2.2.6-54.el8_9
  • cups-client AlmaLinux 8 1:2.2.6-54.el8_9
  • cups-ipptool AlmaLinux 8 1:2.2.6-54.el8_9
  • cups-filesystem AlmaLinux 8 1:2.2.6-54.el8_9
  • cups AlmaLinux 9 1:2.3.3op2-21.el9
  • cups-lpd AlmaLinux 9 1:2.3.3op2-21.el9

almalinux advisories ALSA-2023:7165ALSA-2023:6596

  • cups Alpine 3.15 2.3.3-r8
  • cups Alpine 3.16 2.4.2-r2
  • cups Alpine 3.17 2.4.2-r3

alpine advisories ALPINE-CVE-2023-34241

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cups CBL-Mariner 2.0 2.3.3op2-7
  • cups Azure Linux 3.0 2.4.10-1

azure linux advisories AZL-37074AZL-37099

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-34241 updated cvss 7.1

cups: use-after-free in cupsdAcceptClient() in scheduler/client.c

  • Red Hat Enterprise Linux 6 cups, cups-lpd, cups-php, cups-libs Red Hat Enterprise Linux 7 cups, cups-lpd, cups-libs, cups-client, cups-ipptool, cups-filesystem
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) cups 2.2.6-54.el8_9, cups-lpd 2.2.6-54.el8_9, cups-client 2.2.6-54.el8_9, cups-ipptool 2.2.6-54.el8_9, cups-filesystem 2.2.6-54.el8_9
    fixed: vendor fix RHSA-2023:7165
  • Red Hat Enterprise Linux AppStream (v. 9) cups 2.3.3op2-21.el9, cups-lpd 2.3.3op2-21.el9, cups-client 2.3.3op2-21.el9, cups-ipptool 2.3.3op2-21.el9, cups-filesystem 2.3.3op2-21.el9, cups-printerapp 2.3.3op2-21.el9
    fixed: vendor fix RHSA-2023:6596
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) cups 2.2.6-45.el8_6.4, cups-lpd 2.2.6-45.el8_6.4, cups-client 2.2.6-45.el8_6.4, cups-ipptool 2.2.6-45.el8_6.4, cups-filesystem 2.2.6-45.el8_6.4
    fixed: vendor fix RHSA-2024:1101
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) cups 2.2.6-51.el8_8.3, cups-lpd 2.2.6-51.el8_8.3, cups-client 2.2.6-51.el8_8.3, cups-ipptool 2.2.6-51.el8_8.3, cups-filesystem 2.2.6-51.el8_8.3
    fixed: vendor fix RHSA-2024:1409
  • Red Hat Enterprise Linux BaseOS (v. 8) cups 2.2.6-54.el8_9, cups-libs 2.2.6-54.el8_9
    fixed: vendor fix RHSA-2023:7165
  • Red Hat Enterprise Linux BaseOS (v. 9) cups 2.3.3op2-21.el9, cups-libs 2.3.3op2-21.el9
    fixed: vendor fix RHSA-2023:6596
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) cups 2.2.6-45.el8_6.4, cups-libs 2.2.6-45.el8_6.4
    fixed: vendor fix RHSA-2024:1101
show 1 more
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) cups 2.2.6-51.el8_8.3, cups-libs 2.2.6-51.el8_8.3
    fixed: vendor fix RHSA-2024:1409

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
22 mo ago

Exploit prediction

1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

  • OpenPrinting cups

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.