This Red Hat security advisory addresses two vulnerabilities in CUPS: CVE-2025-58060, an authentication bypass in authorization handling, and CVE-2025-58364, a null pointer dereference in the ipp_read_io() function causing remote denial of service. Both vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support versions on multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory classifies the impact as Important and provides updated packages to remediate these issues. The vendor advisory includes detailed package versions and references for patching. No CVSS scores are provided, and no exploits are currently known in the wild.

The authentication bypass vulnerability (CVE-2025-58060) could allow unauthorized users to bypass CUPS authorization controls, potentially enabling unauthorized access to printing services. The null pointer dereference vulnerability (CVE-2025-58364) could cause a remote denial of service by crashing the CUPS service. Both vulnerabilities impact the availability and security of the printing system on affected Red Hat Enterprise Linux 9.4 systems. The vendor rates the overall security impact as Important.

Red Hat has released updated CUPS packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2025:16592 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches will remediate the authentication bypass and denial of service issues. There are no indications that additional mitigations beyond patching are required.