ubuntu-cve-2025-58060
Vulnerability from osv_ubuntu
Published
2025-09-11 13:00
Modified
2026-04-22 07:56
Summary
Details
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.
Severity
8.0 (High)
N/A (UNKNOWN)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "cups",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-bsd",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-client",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-common",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-core-drivers",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-daemon",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-ipp-utils",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-ppdc",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "cups-server-common",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "libcups2",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "libcupscgi1",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "libcupsimage2",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "libcupsmime1",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
},
{
"binary_name": "libcupsppdc1",
"binary_version": "2.1.3-4ubuntu0.11+esm9"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "cups",
"purl": "pkg:deb/ubuntu/cups@2.1.3-4ubuntu0.11+esm9?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.3-4ubuntu0.11+esm9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.1.0-4ubuntu3",
"2.1.0-5",
"2.1.0-6",
"2.1.0-6ubuntu1",
"2.1.0-7",
"2.1.2-1",
"2.1.2-2",
"2.1.3-1",
"2.1.3-1build1",
"2.1.3-3",
"2.1.3-4",
"2.1.3-4ubuntu0.2",
"2.1.3-4ubuntu0.3",
"2.1.3-4ubuntu0.4",
"2.1.3-4ubuntu0.5",
"2.1.3-4ubuntu0.6",
"2.1.3-4ubuntu0.7",
"2.1.3-4ubuntu0.8",
"2.1.3-4ubuntu0.9",
"2.1.3-4ubuntu0.10",
"2.1.3-4ubuntu0.11",
"2.1.3-4ubuntu0.11+esm1",
"2.1.3-4ubuntu0.11+esm2",
"2.1.3-4ubuntu0.11+esm3",
"2.1.3-4ubuntu0.11+esm4",
"2.1.3-4ubuntu0.11+esm5",
"2.1.3-4ubuntu0.11+esm6",
"2.1.3-4ubuntu0.11+esm7",
"2.1.3-4ubuntu0.11+esm8"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "cups",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-bsd",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-client",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-common",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-core-drivers",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-daemon",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-ipp-utils",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-ppdc",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "cups-server-common",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "libcups2",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "libcupscgi1",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "libcupsimage2",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "libcupsmime1",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
},
{
"binary_name": "libcupsppdc1",
"binary_version": "2.2.7-1ubuntu2.10+esm7"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "cups",
"purl": "pkg:deb/ubuntu/cups@2.2.7-1ubuntu2.10+esm7?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.7-1ubuntu2.10+esm7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.2.4-7ubuntu2",
"2.2.5-2",
"2.2.6-2",
"2.2.6-3",
"2.2.6-4",
"2.2.6-5",
"2.2.7-1ubuntu1",
"2.2.7-1ubuntu2",
"2.2.7-1ubuntu2.1",
"2.2.7-1ubuntu2.2",
"2.2.7-1ubuntu2.3",
"2.2.7-1ubuntu2.4",
"2.2.7-1ubuntu2.5",
"2.2.7-1ubuntu2.6",
"2.2.7-1ubuntu2.7",
"2.2.7-1ubuntu2.8",
"2.2.7-1ubuntu2.9",
"2.2.7-1ubuntu2.10",
"2.2.7-1ubuntu2.10+esm1",
"2.2.7-1ubuntu2.10+esm2",
"2.2.7-1ubuntu2.10+esm3",
"2.2.7-1ubuntu2.10+esm4",
"2.2.7-1ubuntu2.10+esm5",
"2.2.7-1ubuntu2.10+esm6"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "cups",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-bsd",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-client",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-common",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-core-drivers",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-daemon",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-ipp-utils",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-ppdc",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "cups-server-common",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "libcups2",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
},
{
"binary_name": "libcupsimage2",
"binary_version": "2.3.1-9ubuntu1.9+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "cups",
"purl": "pkg:deb/ubuntu/cups@2.3.1-9ubuntu1.9+esm1?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.1-9ubuntu1.9+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.2.12-2ubuntu1",
"2.3.0-6",
"2.3.0-7",
"2.3.0-7ubuntu1",
"2.3.1-1ubuntu1",
"2.3.1-2",
"2.3.1-4",
"2.3.1-7",
"2.3.1-9ubuntu1",
"2.3.1-9ubuntu1.1",
"2.3.1-9ubuntu1.2",
"2.3.1-9ubuntu1.3",
"2.3.1-9ubuntu1.4",
"2.3.1-9ubuntu1.5",
"2.3.1-9ubuntu1.6",
"2.3.1-9ubuntu1.7",
"2.3.1-9ubuntu1.8",
"2.3.1-9ubuntu1.9"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "cups",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-bsd",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-client",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-common",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-core-drivers",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-daemon",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-ipp-utils",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-ppdc",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "cups-server-common",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "libcups2",
"binary_version": "2.4.1op1-1ubuntu4.12"
},
{
"binary_name": "libcupsimage2",
"binary_version": "2.4.1op1-1ubuntu4.12"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "cups",
"purl": "pkg:deb/ubuntu/cups@2.4.1op1-1ubuntu4.12?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.1op1-1ubuntu4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.3op2-7ubuntu2",
"2.4.1op1-1ubuntu1",
"2.4.1op1-1ubuntu2",
"2.4.1op1-1ubuntu3",
"2.4.1op1-1ubuntu4",
"2.4.1op1-1ubuntu4.1",
"2.4.1op1-1ubuntu4.2",
"2.4.1op1-1ubuntu4.4",
"2.4.1op1-1ubuntu4.6",
"2.4.1op1-1ubuntu4.7",
"2.4.1op1-1ubuntu4.8",
"2.4.1op1-1ubuntu4.9",
"2.4.1op1-1ubuntu4.10",
"2.4.1op1-1ubuntu4.11"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "cups",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-bsd",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-client",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-common",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-core-drivers",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-daemon",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-ipp-utils",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-ppdc",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "cups-server-common",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "libcups2t64",
"binary_version": "2.4.7-1.2ubuntu7.4"
},
{
"binary_name": "libcupsimage2t64",
"binary_version": "2.4.7-1.2ubuntu7.4"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "cups",
"purl": "pkg:deb/ubuntu/cups@2.4.7-1.2ubuntu7.4?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7-1.2ubuntu7.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.6-0ubuntu3",
"2.4.7-1.2ubuntu2",
"2.4.7-1.2ubuntu3",
"2.4.7-1.2ubuntu7",
"2.4.7-1.2ubuntu7.1",
"2.4.7-1.2ubuntu7.2",
"2.4.7-1.2ubuntu7.3"
]
}
],
"aliases": [],
"details": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.",
"id": "UBUNTU-CVE-2025-58060",
"modified": "2026-04-22T07:56:55Z",
"published": "2025-09-11T13:00:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2025-58060"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58060"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-7745-1"
}
],
"related": [
"USN-7745-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2025-58060"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…