Re: Multiple CVEs disclosed in CUPS

[Peter Gutmann <pgut001 () cs auckland ac nz>]

Alan Coopersmith <alan.coopersmith () oracle com> writes:

> https://heyitsas.im/posts/cups/ discloses:
> [...]

Hopefully not too off-topic but a related issue with CUPS is that it's
incredibly difficult to remove in order to harden a system.  Under Ubuntu it's
installed by default and deeply embedded into things (some packages can't be
removed at all, try a 'sudo apt purge libcups*' but whatever you do don't hit
'y'), and keeps re-enabling and re-installing itself via different mechanisms
(release-upgrade, snap, etc) once removed.  So the easy mitigation of "don't
do that, then" isn't really available unless you're prepared to spend some
time recursively removing, disabling, and locking out everything involved.

Peter.