Вернуться к предупреждениям о безопасности

Golang-Github-Openprinting-Ipp-Usb Security Update — AlmaLinux 10 (ALSA-2026:88280)

ALSA-2026:88280 updates the ipp-usb component on AlmaLinux 10 — the HTTP reverse proxy that enables driverless printing over IPP-over-USB — fixing four vulnerabilities in its bundled Go networking stack (CVE-2026-78667, CVE-2026-97031, CVE-2026-78669, CVE-2026-111943), including denial-of-service flaws rated 7.5. Update with dnf update ipp-usb. Relevant mainly to servers or workstations that share USB printers.

High 7.5 CVSS 2026-10-24

AlmaLinux 10

Что это значит по лицензии SharedLicense

The Go HTTP component flaws (CWE-770 resource-allocation class) allow denial of service against the print proxy — a niche component, but exploitable where ipp-usb listens on a network-facing interface.

Type:

security

Severity:

important

Release date:

2026-10-24

Description:

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	ipp-usb-0.9.27-7.el10_2.4.aarch64.rpm	473d52c318d3ec07f114a18659a2fed55cc6719f0fad0bdce9b56b77641e46b8
ppc64le	ipp-usb-0.9.27-7.el10_2.4.ppc64le.rpm	ac40c13f5aa89f4bc7e2ad601fd07c0870ea74d16959cb4d0e9b81fdad21cbed
s390x	ipp-usb-0.9.27-7.el10_2.4.s390x.rpm	23836e3d5f9a3006efc93a6fed34524aa5907278f777ad5177952737bcab5c9a
x86_64	ipp-usb-0.9.27-7.el10_2.4.x86_64.rpm	38f05b0511fe7aee4b43146aa225a58c3ca89daf3b6fbee09af13db14f375e3d
x86_64_v2	ipp-usb-0.9.27-7.el10_2.4.x86_64_v2.rpm	dd7e967d650ae1acc24c166566c0f0e1cc238d8a4a4290b8831a4ffd81cadad0

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is ALSA-2026:88280?

It is AlmaLinux's Important-rated erratum for ipp-usb on AlmaLinux 10, the proxy that backs driverless IPP-over-USB printing. It fixes four Go-stack vulnerabilities (CVE-2026-78667, CVE-2026-97031, CVE-2026-78669 and CVE-2026-111943), including denial-of-service issues rated CVSS 7.5 (CWE-770).

Do I need this update on a web hosting server?

Only if ipp-usb is installed — typically desktop or print-server use. Web hosting servers without USB printers usually do not run it; dnf update ipp-usb on the rare installs closes it.

How do I apply the fix?

Run dnf update ipp-usb (or a general dnf update) on AlmaLinux 10, then restart the ipp-usb service if it is enabled.

Why does a printer proxy bundle Go CVEs?

ipp-usb is written in Go and embeds the Go networking libraries — flaws in golang.org/x/net and the standard library (denial of service via crafted requests) surface in every Go binary that vendors them, fixed here by rebuilding against the patched Go.

Источники

Предупреждения о безопасности

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему

Часто задаваемые вопросы

Похожие предупреждения

Проверьте систему на уязвимости