ALAS2023-2026-1475

References: CVE-2026-28295  CVE-2026-28296 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network. (CVE-2026-28295)

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts. (CVE-2026-28296)

Issue Correction:
Run dnf update gvfs --releasever 2023.10.20260316 or dnf update --advisory ALAS2023-2026-1475 --releasever 2023.10.20260316 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    gvfs-nfs-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-goa-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-client-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-archive-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-smb-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-fuse-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-smb-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-goa-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-archive-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-client-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-nfs-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-fuse-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-debuginfo-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-1.56.1-1.amzn2023.0.2.aarch64
    gvfs-debugsource-1.56.1-1.amzn2023.0.2.aarch64

src:
    gvfs-1.56.1-1.amzn2023.0.2.src

x86_64:
    gvfs-archive-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-client-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-client-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-smb-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-archive-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-fuse-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-goa-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-nfs-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-debuginfo-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-fuse-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-goa-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-smb-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-nfs-1.56.1-1.amzn2023.0.2.x86_64
    gvfs-debugsource-1.56.1-1.amzn2023.0.2.x86_64