Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3993
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
The PackagerResolver of Apache Ivy is able to download online
artifacts and to (re)package them in a format defined by a
packager.xml file. This repackaging is done by an Ant script, which is
stored in a subdirectory of the configured "buildRoot" directory. This
subdirectory is calculated based on modules coordinates, like the
organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid
characters for Ivy coordinates in general- it is possible to break out
of the configured "buildRoot" directory where other files can be
overwritten.
In order to exploit this vulnerability an attacker needs to have
access to a packager repository and add or modify the coordinates in
ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0. (CVE-2026-26032)
Affected Packages:
apache-ivy
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update apache-ivy or yum update --advisory ALAS2-2026-3993 to update your system.
noarch:
apache-ivy-2.3.0-4.amzn2.0.3.noarch
apache-ivy-javadoc-2.3.0-4.amzn2.0.3.noarch
src:
apache-ivy-2.3.0-4.amzn2.0.3.src