Package: cups Version: 2.2.1-8+deb9u2 Severity: important Hi,
in debian stable, the ipp backend is not using the kerberos ticket of the user. This bug is reported (https://github.com/apple/cups/issues/5233) and fixed upstream (https://github.com/apple/cups/commit/c59948f6fb2261653593c7d09ed2c0f673f610e2). Please consider applying this patch to the stable branch as it fixes a security related bug and would allow users to use kerberos for securing access to an remote printer queue. Thank you Felix -- System Information: Debian Release: 9.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.9.0-7-amd64 (SMP w/4 CPU cores) Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de_DE.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages cups depends on: ii cups-client 2.2.1-8+deb9u2 ii cups-common 2.2.1-8+deb9u2 ii cups-core-drivers 2.2.1-8+deb9u2 ii cups-daemon 2.2.1-8+deb9u2 ii cups-filters 1.11.6-3 ii cups-ppdc 2.2.1-8+deb9u1 ii cups-server-common 2.2.1-8+deb9u2 ii debconf [debconf-2.0] 1.5.61 ii ghostscript 9.20~dfsg-3.2+deb9u2 ii libavahi-client3 0.6.32-2 ii libavahi-common3 0.6.32-2 ii libc-bin 2.24-11+deb9u3 ii libc6 2.24-11+deb9u3 ii libcups2 2.2.1-8+deb9u2 ii libcupscgi1 2.2.1-8+deb9u2 ii libcupsimage2 2.2.1-8+deb9u2 ii libcupsmime1 2.2.1-8+deb9u2 ii libcupsppdc1 2.2.1-8+deb9u2 ii libgcc1 1:6.3.0-18+deb9u1 ii libstdc++6 6.3.0-18+deb9u1 ii libusb-1.0-0 2:1.0.21-1 ii poppler-utils 0.48.0-2+deb9u2 ii procps 2:3.3.12-3+deb9u1 Versions of packages cups recommends: pn avahi-daemon <none> pn colord <none> ii cups-filters [ghostscript-cups] 1.11.6-3 ii printer-driver-gutenprint 5.2.11-1+b2 Versions of packages cups suggests: pn cups-bsd <none> pn cups-pdf <none> pn foomatic-db-compressed-ppds | foomatic-db <none> ii hplip 3.16.11+repack0-3 ii printer-driver-hpcups 3.16.11+repack0-3 pn smbclient <none> ii udev 232-25+deb9u4 -- debconf information excluded
