Amazon Linux 2023 Security Advisory: ALAS2023-2026-3181
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-11-02
FAQs regarding Amazon Linux ALAS/CVE Severity
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation. (CVE-2026-100419)
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL. (CVE-2026-82249)
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication. (CVE-2026-82250)
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories. (CVE-2026-82251)
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values. (CVE-2026-82252)
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. (CVE-2026-82253)
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades. (CVE-2026-82255)
Affected Packages:
rust-cargo-c
Issue Correction:
Run dnf update rust-cargo-c --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3181 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
cargo-c-debuginfo-0.10.25-1.amzn2023.0.1.aarch64
cargo-c-0.10.25-1.amzn2023.0.1.aarch64
rust-cargo-c-debugsource-0.10.25-1.amzn2023.0.1.aarch64
src:
rust-cargo-c-0.10.25-1.amzn2023.0.1.src
x86_64:
cargo-c-0.10.25-1.amzn2023.0.1.x86_64
rust-cargo-c-debugsource-0.10.25-1.amzn2023.0.1.x86_64
cargo-c-debuginfo-0.10.25-1.amzn2023.0.1.x86_64
2026-11-02: CVE-2026-82251 was added to this advisory.
2026-11-02: CVE-2026-82252 was added to this advisory.
2026-11-02: CVE-2026-82250 was added to this advisory.
2026-11-02: CVE-2026-82254 was added to this advisory.
2026-11-02: CVE-2026-82253 was added to this advisory.
2026-11-02: CVE-2026-82255 was added to this advisory.
2026-11-02: CVE-2026-82249 was added to this advisory.