PaperCut Print Deploy Security Bulletin (September 2025)

Executive Summary

CVE-2025-9785 has been raised relating to installations of Print Deploy. Older documentation surrounding the configuration of SSL/TLS certificate validation prior to the release of Print Deploy version 1.9.2917 (prior to 7 July 2025) was lacking and it is likely that customers may have configured their Print Deploy installation insecurely despite following the documentation on enabling SSL certificate validation. This issue can be resolved with a simple configuration update.

Background

For versions of Print Deploy older than Print Deploy version 1.9.2917 (prior to 7 July 2025), we’ve found the documentation was lacking information surrounding the configuration of the SSL/TLS certificate validation. As a result it is likely that the customers may have configured their Print Deploy installation insecurely despite following the documentation on enabling the SSL certificate validation. This may potentially lead to a man-in-the-middle attack against the clients connecting to the Print Deploy servers.

Starting from Print Deploy version 1.9.2917, the documentation has been updated to address this issue. The updated documentation contains an additional step to configure the updater settings file. From Print Deploy version 1.9.2917, specifying STRICT_SSL=yes on the installer command line will apply the documented changes to the updater settings file automatically saving system administrators’ time and effort.

PaperCut NG/MF is configurable with self-signed certificates and for servers using self signed certificates, to mitigate the possibility of the man-in-the-middle attack, it is recommended to add the self-signed certificate to a system’s CA (Certificate Authority) bundle and make the operating system or specific applications trust that certificate, even though it wasn’t issued by a known CA. The exact steps vary depending on the operating system and generally go beyond PaperCut’s product documentation.

Self-signed certificates are known to be vulnerable to man-in-the-middle attacks and so CA signed certificates should be preferred. However, PaperCut recognises that in some circumstances it may be beneficial to rely on the self-signed certificates. If self-signed certificates are used, the recommended strategy for avoiding the possibility of man-in-the-middle attacks is to make sure the certificate must be added to the system’s CA (Certificate Authority) bundle. The exact steps will vary depending on the operating system.