vulnerability
Red Hat: CVE-2017-18190: Moderate: cups security and bug fix update (RHSA-2020:3864)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Feb 16, 2018 | Oct 1, 2020 | Feb 19, 2026 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Feb 16, 2018
Added
Oct 1, 2020
Modified
Feb 19, 2026
Description
A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
Solutions
redhat-upgrade-cupsredhat-upgrade-cups-clientredhat-upgrade-cups-debuginforedhat-upgrade-cups-develredhat-upgrade-cups-filesystemredhat-upgrade-cups-ipptoolredhat-upgrade-cups-libsredhat-upgrade-cups-lpd
References
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.