Use cupsGetRand for web interface session IDs - #1696
Open
Elvand-Lie wants to merge 1 commit into
Open
Conversation
Elvand-Lie
marked this pull request as draft
September 11, 2026 17:26
The web interface session ID is generated from a time-seeded PRNG mixed with REMOTE_ADDR, SERVER_NAME and SERVER_PORT. On configurations where CUPS_RAND is random(), the ID is predictable from values the requester already knows. CVE-2018-4700 improved the seed resolution but kept it time-derived; Project Zero issue 42450776 asked for real entropy. Generate the ID from 16 bytes of cupsGetRand, keeping the 32-character hexadecimal cookie format. Follow-up to OpenPrinting#1695, reworked to use cupsGetRand as suggested there.
Elvand-Lie
marked this pull request as ready for review
September 11, 2026 17:32
Elvand-Lie
force-pushed
the
sid-cupsgetrand
branch
from
September 11, 2026 17:32
75f34e9 to
7426fdb
Compare
Elvand-Lie
marked this pull request as draft
September 11, 2026 17:35
Elvand-Lie
marked this pull request as ready for review
September 11, 2026 17:45
Member
Seriously, seeding with microseconds may not be sufficient for crypto, but for a CSRF token of a web interface whose request/response timing is measured in milliseconds it is more than sufficient. |
michaelrsweet
approved these changes
Sep 11, 2026
michaelrsweet
left a comment
michaelrsweet
left a comment
Member
There was a problem hiding this comment.
Generally looks OK, although we'll need to do some cleanup and this change doesn't get top billing in the changelog...
michaelrsweet
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The web interface session ID is the CSRF token. Right now it comes from a time-seeded PRNG mixed with values the requester already knows, so it's predictable on plenty of Linux setups. CVE-2018-4700 only improved the seed resolution. Project Zero asked for real entropy in 2018 (issue 42450776), never landed.
This takes 16 bytes from cupsGetRand instead. Same 32-hex cookie format. Nothing else changes. Rework of #1695 like you suggested. Same construction is still on 2.4.x.