Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-178
Advisory Release Date: 2026-10-12 09:00 Pacific
Advisory Updated Date: 2026-10-20 15:48 Pacific
Severity:
Important
Issue Overview:
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-100419:
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
Affected Packages:
rust-cargo-c
Issue Correction:
Run dnf update rust-cargo-c or dnf update --advisory ALAS2027-2026-178 to update your system.
New Packages:
aarch64:
cargo-c-debuginfo-0.10.25-1.amzn2027.aarch64
cargo-c-0.10.25-1.amzn2027.aarch64
rust-cargo-c-debugsource-0.10.25-1.amzn2027.aarch64
src:
rust-cargo-c-0.10.25-1.amzn2027.src
x86_64:
cargo-c-debuginfo-0.10.25-1.amzn2027.x86_64
cargo-c-0.10.25-1.amzn2027.x86_64
rust-cargo-c-debugsource-0.10.25-1.amzn2027.x86_64