ALAS2-2026-3808

References: CVE-2026-40034  CVE-2026-82252  CVE-2026-82253  CVE-2026-82254  CVE-2026-82255 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution. (CVE-2026-40034)

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values. (CVE-2026-82252)

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. (CVE-2026-82253)

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)

gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades. (CVE-2026-82255)

Issue Correction:
Run yum update rust or yum update --advisory ALAS2-2026-3808 to update your system.

New Packages:

aarch64:
    rust-1.97.0-1.amzn2.0.1.aarch64
    rust-std-static-1.97.0-1.amzn2.0.1.aarch64
    rust-doc-1.97.0-1.amzn2.0.1.aarch64
    cargo-1.97.0-1.amzn2.0.1.aarch64
    rustfmt-1.97.0-1.amzn2.0.1.aarch64
    rust-analyzer-1.97.0-1.amzn2.0.1.aarch64
    clippy-1.97.0-1.amzn2.0.1.aarch64

noarch:
    rust-debugger-common-1.97.0-1.amzn2.0.1.noarch
    rust-gdb-1.97.0-1.amzn2.0.1.noarch
    rust-src-1.97.0-1.amzn2.0.1.noarch
    rust-toolset-srpm-macros-1.97.0-1.amzn2.0.1.noarch
    rust-toolset-1.97.0-1.amzn2.0.1.noarch

src:
    rust-1.97.0-1.amzn2.0.1.src

x86_64:
    rust-1.97.0-1.amzn2.0.1.x86_64
    rust-std-static-1.97.0-1.amzn2.0.1.x86_64
    rust-doc-1.97.0-1.amzn2.0.1.x86_64
    cargo-1.97.0-1.amzn2.0.1.x86_64
    rustfmt-1.97.0-1.amzn2.0.1.x86_64
    rust-analyzer-1.97.0-1.amzn2.0.1.x86_64
    clippy-1.97.0-1.amzn2.0.1.x86_64

Changelog:

2026-11-02: CVE-2026-82252 was added to this advisory.

2026-11-02: CVE-2026-82254 was added to this advisory.

2026-11-02: CVE-2026-82255 was added to this advisory.

2026-11-02: CVE-2026-82253 was added to this advisory.