From 1573471a88ce085e8937e6c16b2ada290073596c Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 15 Mar 2026 19:15:14 +0100 Subject: [PATCH] CVE-2026-4480: printing: Shell-sanitize jobname passed as %J to "print command" Fix an unauthenticated remote code execution vulnerability with printing set to anything *but* cups and iprint, for example "lprng", so that "print command" is executed upon job submission. If the client-controlled job name is handed to the "print command" via "%J", rpcd_spoolssd passes this to the shell without escaping critical characters. Bug: https://bugzilla.samba.org/show_bug.cgi?id=16033 Signed-off-by: Volker Lendecke --- source3/printing/print_generic.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c index 7c7a14de045..c021fd1bcef 100644 --- a/source3/printing/print_generic.c +++ b/source3/printing/print_generic.c @@ -255,12 +255,17 @@ static int generic_job_submit(int snum, struct printjob *pjob, return -1; } - jobname = talloc_strdup(ctx, pjob->jobname); - if (!jobname) { - ret = -1; - goto out; + { + char *name = escape_shell_string(pjob->jobname); + if (name == NULL) { + ret = -1; + goto out; + } + + jobname = talloc_string_sub(ctx, name, "'", "_"); + SAFE_FREE(name); } - jobname = talloc_string_sub(ctx, jobname, "'", "_"); + if (!jobname) { ret = -1; goto out; -- 2.34.1