Amazon Linux 2023 Security Advisory: ALAS2023-2026-3207
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
The PackagerResolver of Apache Ivy is able to download online
artifacts and to (re)package them in a format defined by a
packager.xml file. This repackaging is done by an Ant script, which is
stored in a subdirectory of the configured "buildRoot" directory. This
subdirectory is calculated based on modules coordinates, like the
organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid
characters for Ivy coordinates in general- it is possible to break out
of the configured "buildRoot" directory where other files can be
overwritten.
In order to exploit this vulnerability an attacker needs to have
access to a packager repository and add or modify the coordinates in
ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0. (CVE-2026-26032)
Affected Packages:
apache-ivy
Issue Correction:
Run dnf update apache-ivy --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3207 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
noarch:
apache-ivy-2.5.1-1.amzn2023.0.3.noarch
apache-ivy-javadoc-2.5.1-1.amzn2023.0.3.noarch
src:
apache-ivy-2.5.1-1.amzn2023.0.3.src