Amazon Linux 2023 Security Advisory: ALAS2023-2026-2113
Advisory Released Date: 2026-08-31
Advisory Updated Date: 2026-08-31
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account. (CVE-2026-5917)
Affected Packages:
rust-cargo-c
Issue Correction:
Run dnf update rust-cargo-c --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2113 --releasever 2023.12.20260831 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
cargo-c-debuginfo-0.10.21-1.amzn2023.0.2.aarch64
cargo-c-0.10.21-1.amzn2023.0.2.aarch64
rust-cargo-c-debugsource-0.10.21-1.amzn2023.0.2.aarch64
src:
rust-cargo-c-0.10.21-1.amzn2023.0.2.src
x86_64:
cargo-c-debuginfo-0.10.21-1.amzn2023.0.2.x86_64
cargo-c-0.10.21-1.amzn2023.0.2.x86_64
rust-cargo-c-debugsource-0.10.21-1.amzn2023.0.2.x86_64