CVE-2023-20197

What it actually does

Incorrect completion check during HFS+ filesystem image decompression creates an infinite loop that halts the scanning process and exhausts system resources.

Why it matters to the business

Scanning services become unresponsive, blocking file inspection workflows, consuming CPU and memory, and potentially disrupting printing or content-processing pipelines until the process is restarted.

How an attack unfolds

An attacker crafts a malicious HFS+ filesystem image and submits it for scanning; the parser enters a loop on decompression and never completes, causing denial of service.

How to fix it

Upgrade openprinting/cups-filters to the commit 9d4b76bc778a77c3d984b002cb956b18deec2b63 or later; rebuild and redeploy packages that embed the vulnerable parser; restart affected services after upgrade.

How to confirm the fix worked

Confirm the installed cups-filters source contains commit 9d4b76bc778a77c3d984b002cb956b18deec2b63; run regression tests with known-good and known-bad HFS+ images to verify the loop condition no longer occurs.

Typical attack path

1. Identify a reachable service that invokes the HFS+ parser on untrusted input
2. Prepare a specially crafted HFS+ filesystem image that triggers the incomplete decompression check
3. Submit the image to the scanner (e.g., via print job, file upload, or mail attachment)
4. Observe the scanning process enter an infinite loop and cease responding

How to detect it

Monitor scanner process CPU and memory usage for sustained 100 % utilization without completion; review logs for repeated HFS+ image processing entries that never finish; correlate with submission of filesystem images.

What your security team should do

• Apply the fixed commit immediately on all internet-facing or multi-tenant instances
• Add resource limits and process restarts for the scanner to limit blast radius until patched
• Inventory all downstream packages that depend on the vulnerable cups-filters code