CVE-2017-18190
Publication date 16 February 2018
Last updated 25 August 2025
Ubuntu priority
Description
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cups | ||
| 16.04 LTS xenial |
Fixed 2.1.3-4ubuntu0.4
|
|
| 14.04 LTS trusty |
Fixed 1.7.2-0ubuntu1.9
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
Related Ubuntu Security Notices (USN)
- USN-3577-1
- CUPS vulnerability
- 21 February 2018