ALAS2023-2026-1568

References: CVE-2026-0810  CVE-2026-33055  CVE-2026-33056 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw in the gix-date library can generate invalid non-UTF8 strings, leading to undefined behavior when processed. The most likely impact from a successful attack is to data integrity, by the malicious data being able to corrupt data being hold in memory and to system availability as it eventually may lead to the software using the gix_date library to crash. (CVE-2026-0810)

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45. (CVE-2026-33055)

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory -- and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45. (CVE-2026-33056)

Issue Correction:
Run dnf update rust --releasever 2023.11.20260413 or dnf update --advisory ALAS2023-2026-1568 --releasever 2023.11.20260413 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    rust-analyzer-debuginfo-1.94.0-1.amzn2023.0.2.aarch64
    rust-debuginfo-1.94.0-1.amzn2023.0.2.aarch64
    clippy-debuginfo-1.94.0-1.amzn2023.0.2.aarch64
    rustfmt-debuginfo-1.94.0-1.amzn2023.0.2.aarch64
    rust-std-static-1.94.0-1.amzn2023.0.2.aarch64
    cargo-debuginfo-1.94.0-1.amzn2023.0.2.aarch64
    rust-1.94.0-1.amzn2023.0.2.aarch64
    rust-analyzer-1.94.0-1.amzn2023.0.2.aarch64
    clippy-1.94.0-1.amzn2023.0.2.aarch64
    rustfmt-1.94.0-1.amzn2023.0.2.aarch64
    cargo-1.94.0-1.amzn2023.0.2.aarch64
    rust-debugsource-1.94.0-1.amzn2023.0.2.aarch64
    rust-doc-1.94.0-1.amzn2023.0.2.aarch64

noarch:
    rust-gdb-1.94.0-1.amzn2023.0.2.noarch
    rust-toolset-srpm-macros-1.94.0-1.amzn2023.0.2.noarch
    rust-debugger-common-1.94.0-1.amzn2023.0.2.noarch
    rust-std-static-wasm32-unknown-unknown-1.94.0-1.amzn2023.0.2.noarch
    rust-lldb-1.94.0-1.amzn2023.0.2.noarch
    rust-toolset-1.94.0-1.amzn2023.0.2.noarch
    rust-std-static-wasm32-wasip1-1.94.0-1.amzn2023.0.2.noarch
    rust-src-1.94.0-1.amzn2023.0.2.noarch

src:
    rust-1.94.0-1.amzn2023.0.2.src

x86_64:
    rustfmt-debuginfo-1.94.0-1.amzn2023.0.2.x86_64
    rust-std-static-1.94.0-1.amzn2023.0.2.x86_64
    rust-debuginfo-1.94.0-1.amzn2023.0.2.x86_64
    rust-analyzer-debuginfo-1.94.0-1.amzn2023.0.2.x86_64
    clippy-1.94.0-1.amzn2023.0.2.x86_64
    cargo-debuginfo-1.94.0-1.amzn2023.0.2.x86_64
    clippy-debuginfo-1.94.0-1.amzn2023.0.2.x86_64
    rust-1.94.0-1.amzn2023.0.2.x86_64
    rustfmt-1.94.0-1.amzn2023.0.2.x86_64
    cargo-1.94.0-1.amzn2023.0.2.x86_64
    rust-analyzer-1.94.0-1.amzn2023.0.2.x86_64
    rust-debugsource-1.94.0-1.amzn2023.0.2.x86_64
    rust-doc-1.94.0-1.amzn2023.0.2.x86_64