more cups-related CVE stuff

Signed-off-by: Weston Steimel <[email protected]>

data/anchore/2024/CVE-2024-47076.json

@@ -0,0 +1,42 @@
+{
+  "additionalMetadata": {
+    "cna": "github_m",
+    "cveId": "CVE-2024-47076",
+    "description": "CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system.",
+    "reason": "Added CPE configurations because not yet analyzed by NVD.",
+    "references": [
+      "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8",
+      "https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47",
+      "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5",
+      "https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6",
+      "https://www.cups.org",
+      "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I"
+    ]
+  },
+  "adp": {
+    "affected": [
+      {
+        "collectionURL": "https://github.com",
+        "cpes": [
+          "cpe:2.3:a:openprinting:libcupsfilters:*:*:*:*:*:*:*:*"
+        ],
+        "packageName": "openprinting/libcupsfilters",
+        "product": "libcupsfilters",
+        "repo": "https://github.com/openprinting/libcupsfilters",
+        "vendor": "OpenPrinting",
+        "versions": [
+          {
+            "lessThanOrEqual": "2.1b1",
+            "status": "affected",
+            "version": "0",
+            "versionType": "custom"
+          }
+        ]
+      }
+    ],
+    "providerMetadata": {
+      "orgId": "00000000-0000-4000-8000-000000000000",
+      "shortName": "anchoreadp"
+    }
+  }
+}

data/anchore/2024/CVE-2024-47176.json

@@ -0,0 +1,42 @@
+{
+  "additionalMetadata": {
+    "cna": "github_m",
+    "cveId": "CVE-2024-47176",
+    "description": "CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL.\n\nDue to the service binding to `*:631 ( INADDR_ANY )`, multiple bugs in `cups-browsed` can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.",
+    "reason": "Added CPE configurations because not yet analyzed by NVD.",
+    "references": [
+      "https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992",
+      "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8",
+      "https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47",
+      "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5",
+      "https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6",
+      "https://www.cups.org",
+      "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I"
+    ]
+  },
+  "adp": {
+    "affected": [
+      {
+        "collectionURL": "https://github.com",
+        "cpes": [
+          "cpe:2.3:a:openprinting:cups-browsed:*:*:*:*:*:*:*:*"
+        ],
+        "packageName": "openprinting/cups-browsed",
+        "product": "cups-browsed",
+        "repo": "https://github.com/openprinting/cups-browsed",
+        "vendor": "OpenPrinting",
+        "versions": [
+          {
+            "status": "affected",
+            "version": "2.0.1",
+            "versionType": "custom"
+          }
+        ]
+      }
+    ],
+    "providerMetadata": {
+      "orgId": "00000000-0000-4000-8000-000000000000",
+      "shortName": "anchoreadp"
+    }
+  }
+}

data/anchore/2024/CVE-2024-47177.json

@@ -18,7 +18,8 @@
       {
         "collectionURL": "https://github.com",
         "cpes": [
-          "cpe:2.3:a:linuxfoundation:cups-filters:*:*:*:*:*:*:*:*"
+          "cpe:2.3:a:linuxfoundation:cups-filters:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:openprinting:cups-filters:*:*:*:*:*:*:*:*"
         ],
         "packageName": "openprinting/cups-filters",
         "product": "cups-filters",