Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82255: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades. CVE-2026-82254: gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills. CVE-2026-82252: gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values. CVE-2026-40034: gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | cargo | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | cargo-debuginfo | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | clippy | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | clippy-debuginfo | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-analyzer | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-analyzer-debuginfo | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-debugger-common | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-debuginfo | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-debugsource | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-doc | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-gdb | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-lldb | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-src | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-std-static | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-std-static-wasm32-unknown-unknown | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-std-static-wasm32-wasip1 | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-toolset | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rust-toolset-srpm-macros | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rustfmt | 0:1.97.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | rustfmt-debuginfo | 0:1.97.0-1.amzn2023.0.1 |
Vulnerabilities 4
-
High 7.8
gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partia…
-
High 7.5
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the rep…
-
High 7.5
gitoxide before 0.69.0 Denial of Service via gix-pack
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory p…
-
Medium 6.8
gitoxide 0.25.4 HTTP Credential Leak via Redirect
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the o…