diff --git a/2024/Advisory-EGI-SVG-2024-23.md b/2024/Advisory-EGI-SVG-2024-23.md new file mode 100644 index 0000000..6bd79eb --- /dev/null +++ b/2024/Advisory-EGI-SVG-2024-23.md @@ -0,0 +1,118 @@ +--- +title: Advisory-EGI-SVG-2024-23 +permalink: /Advisory-EGI-SVG-2024-23 +redirect_from: + - /Advisory-SVG-CVE-2024-47176 + - /Advisory-SVG-CVE-2024-47076 + - /Advisory-SVG-CVE-2024-47175 + +published: false +--- + +## Advisory-EGI-SVG-2024-23 + +# HIGH risk CUPS vulnerabilities + +Date: 2024-10-04 +Updated: 2024-10-08 + +HIGH risk vulnerabilities concerning CUPS which may lead to remote code execution. +Note that CUPS is used for printer management. + + +## IDs AND CVSS SCORE + +EGI SVG ID : EGI-SVG-2024-23 + +CVE ID : CVE-2024-47176, CVE-2024-47076, CVE-2024-47175 + +CVSS Score : Up to 8.6 [R 1] + + +## ACTIONS REQUIRED/RECOMMENDED + +Where sites ARE running CUPS, they should update urgently, using references below. + + +## MITIGATION + +Since this software is related to printer management, it **ought** +**not** to be installed on resources made available to EGI. +Sites may want to use this occasion to make sure of that. + + +## MORE INFORMATION + +Some have assessed this as 'Critical' [R 11], while the EGI SVG is of +the opinion that the assessment by Red Hat is more realistic for EGI, +which then leads to a rating of high risk instead. +A good description is also in [R 12] + + +## STATUS OF THIS ADVISORY + + +_TLP:CLEAR information - Unlimited distribution_ + +https://advisories.egi.eu/Advisory-EGI-SVG-2024-23 + +https://advisories.egi.eu/Advisory-SVG-CVE-47175 + +https://advisories.egi.eu/Advisory-SVG-CVE-47076 + +https://advisories.egi.eu/Advisory-SVG-CVE-47176 + +Minor updates may be made without re-distribution to the sites. + + +## CONTACT AND OTHER INFORMATION ON SVG + + This advisory is subject to the Creative Commons licence + https://creativecommons.org/licenses/by/4.0/ and + the EGI (https://www.egi.eu/) Software Vulnerability Group + must be credited. + + +Comments or questions should be sent to + svg-rat at mailman.egi.eu + +Vulnerabilities relevant for EGI can be reported at + report-vulnerability at egi.eu + +(see [R 99] for further details, and other information on SVG) + + +## REFERENCES + +- [R 1] + +- [R 2] + +- [R 3] + +- [R 4] + +- [R 5] + +- [R 6] + +- [R 7] + +- [R 8] + +- [R 9] (RockyLinux) + +- [R 10] (AlmaLinux) + +- [R 11] + +- [R 12] + + +- [R 99] + +## CREDITS + +SVG was alerted to this vulnerability by Sebastian Luna Valero + +