diff --git a/cups-getpass.patch b/cups-getpass.patch
new file mode 100644
index 0000000..e1d2d20
--- /dev/null
+++ b/cups-getpass.patch
@@ -0,0 +1,35 @@
+--- cups-1.2.6/cups/usersys.c.getpass	2006-08-29 16:51:19.000000000 +0100
++++ cups-1.2.6/cups/usersys.c	2006-11-13 15:57:18.000000000 +0000
+@@ -46,6 +46,7 @@
+ #include "globals.h"
+ #include <stdlib.h>
+ #include <sys/stat.h>
++#include <termios.h>
+ #ifdef WIN32
+ #  include <windows.h>
+ #endif /* WIN32 */
+@@ -455,7 +456,23 @@
+ const char *				/* O - Password */
+ _cupsGetPassword(const char *prompt)	/* I - Prompt string */
+ {
+-  return (getpass(prompt));
++  static char password[100];
++  struct termios old, new;
++  int nread;
++  tcgetattr (STDIN_FILENO, &old);
++  new = old;
++  new.c_lflag &= ~ECHO;
++  tcsetattr (STDIN_FILENO, TCSAFLUSH, &new);
++  fputs (prompt, stdout);
++  fflush (stdout);
++  nread = read (STDIN_FILENO, password, sizeof (password));
++  tcsetattr (STDIN_FILENO, TCSAFLUSH, &old);
++  fputc ('\n', stdout);
++  if (nread > 0)
++    password[nread - 1] = '\0';
++  else
++    password[0] ='\0';
++  return password;
+ }
+ #endif /* WIN32 */
+ 
diff --git a/cups.spec b/cups.spec
index 5fa5484..11fe825 100644
--- a/cups.spec
+++ b/cups.spec
@@ -43,6 +43,7 @@ Patch16: cups-pid.patch
 Patch17: cups-relro.patch
 Patch18: cups-directed-broadcast.patch
 Patch19: cups-eggcups.patch
+Patch20: cups-getpass.patch
 Patch100: cups-lspp.patch
 Epoch: 1
 Url: http://www.cups.org/
@@ -144,6 +145,7 @@ lpd emulation.
 %patch17 -p1 -b .relro
 %patch18 -p1 -b .directed-broadcast
 %patch19 -p1 -b .eggcups
+%patch20 -p1 -b .getpass
 
 %if %lspp
 %patch100 -p1 -b .lspp
@@ -422,6 +424,9 @@ rm -rf $RPM_BUILD_ROOT
 %{cups_serverbin}/daemon/cups-lpd
 
 %changelog
+* Mon Nov 13 2006 Tim Waugh <twaugh@redhat.com>
+- Don't use getpass() (bug #125133).
+
 * Fri Nov 10 2006 Tim Waugh <twaugh@redhat.com> 1:1.2.6-5
 - Reload, don't restart, when logrotating (bug #215023).