ALAS2023-2026-1472

References: CVE-2026-0964  CVE-2026-0967 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

libssh: SCP Protocol Path Traversal in ssh_scp_pull_request() (CVE-2026-0964)

libssh: Specially crafted patterns could cause DoS (CVE-2026-0967)

Issue Correction:
Run dnf update libssh --releasever 2023.10.20260316 or dnf update --advisory ALAS2023-2026-1472 --releasever 2023.10.20260316 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libssh-debugsource-0.10.6-1.amzn2023.0.5.aarch64
    libssh-debuginfo-0.10.6-1.amzn2023.0.5.aarch64
    libssh-0.10.6-1.amzn2023.0.5.aarch64
    libssh-devel-0.10.6-1.amzn2023.0.5.aarch64

noarch:
    libssh-config-0.10.6-1.amzn2023.0.5.noarch

src:
    libssh-0.10.6-1.amzn2023.0.5.src

x86_64:
    libssh-debugsource-0.10.6-1.amzn2023.0.5.x86_64
    libssh-debuginfo-0.10.6-1.amzn2023.0.5.x86_64
    libssh-0.10.6-1.amzn2023.0.5.x86_64
    libssh-devel-0.10.6-1.amzn2023.0.5.x86_64