Apple CUPS does not verify TLS, allowing an attacker on the same network to impersonate any previously used IPPS printer (or any device really) via spoofed Bonjour advertisements and, therefore, forcing the Bonjour discovery service to (automatically and silently) connect to an arbitrary host.
