File cups-1.7.5-additional_policies.patch of Package cups.29370

Overview Repositories Revisions Requests Users Attributes Meta

File cups-1.7.5-additional_policies.patch of Package cups.29370

--- conf/cupsd.conf.in.CVE-2023-32360.patched	2023-09-06 16:26:13.913199663 +0200
+++ conf/cupsd.conf.in	2023-09-06 16:27:54.806790851 +0200
@@ -136,6 +136,39 @@ WebInterface @CUPS_WEBIF@
   </Limit>
 </Policy>
 
+# The policy below is added by SUSE during build of our cups package.
+# The policy 'allowallforanybody' is totally open and insecure and therefore
+# it can only be used within an internal network where only trused users exist
+# and where the cupsd is not accessible at all from any external host, see
+# http://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings
+# Have in mind that any user who is allowed to do printer admin tasks
+# can change the print queues as he likes - e.g. send copies of confidental
+# print jobs from an internal network to any external destination, see
+# http://en.opensuse.org/SDB:CUPS_in_a_Nutshell
+# For documentation regarding 'Managing Operation Policies' see
+# https://openprinting.github.io/cups/doc/policies.html
+<Policy allowallforanybody>
+  # Allow anybody to access job's private values:
+  JobPrivateAccess all
+  # Make none of the job values to be private:
+  JobPrivateValues none
+  # Allow anybody to access subscription's private values:
+  SubscriptionPrivateAccess all
+  # Make none of the subscription values to be private:
+  SubscriptionPrivateValues none
+  # Allow anybody to do all IPP operations:
+  # Currently the IPP operations Validate-Job Cancel-Jobs Cancel-My-Jobs Close-Job CUPS-Get-Document
+  # must be additionally exlicitly specified because those IPP operations are not included
+  # in the "All" wildcard value - otherwise cupsd prints error messages of the form
+  # "No limit for Validate-Job defined in policy allowallforanybody and no suitable template found."
+  <Limit All Validate-Job Cancel-Jobs Cancel-My-Jobs Close-Job CUPS-Get-Document>
+    Order deny,allow
+    Allow from all
+  </Limit>
+</Policy>
+# Explicitly set the CUPS 'default' policy to be used by default:
+DefaultPolicy default
+
 #
 # End of "$Id: cupsd.conf.in 11025 2013-06-07 01:00:33Z msweet $".
 #

Places

File cups-1.7.5-additional_policies.patch of Package cups.29370

Places