ALAS2023-2026-3382

References: CVE-2026-82247  CVE-2026-82249 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). (CVE-2026-82247)

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL. (CVE-2026-82249)

Issue Correction:
Run dnf update rust --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3382 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    rust-debuginfo-1.99.1-1.amzn2023.aarch64
    clippy-debuginfo-1.99.1-1.amzn2023.aarch64
    rustfmt-debuginfo-1.99.1-1.amzn2023.aarch64
    rust-debugsource-1.99.1-1.amzn2023.aarch64
    rust-1.99.1-1.amzn2023.aarch64
    cargo-debuginfo-1.99.1-1.amzn2023.aarch64
    rustfmt-1.99.1-1.amzn2023.aarch64
    rust-analyzer-debuginfo-1.99.1-1.amzn2023.aarch64
    rust-std-static-1.99.1-1.amzn2023.aarch64
    rust-analyzer-1.99.1-1.amzn2023.aarch64
    clippy-1.99.1-1.amzn2023.aarch64
    cargo-1.99.1-1.amzn2023.aarch64
    rust-doc-1.99.1-1.amzn2023.aarch64

noarch:
    rust-gdb-1.99.1-1.amzn2023.noarch
    rust-toolset-srpm-macros-1.99.1-1.amzn2023.noarch
    rust-debugger-common-1.99.1-1.amzn2023.noarch
    rust-lldb-1.99.1-1.amzn2023.noarch
    rust-toolset-1.99.1-1.amzn2023.noarch
    rust-std-static-wasm32-unknown-unknown-1.99.1-1.amzn2023.noarch
    rust-std-static-wasm32-wasip1-1.99.1-1.amzn2023.noarch
    rust-src-1.99.1-1.amzn2023.noarch

src:
    rust-1.99.1-1.amzn2023.src

x86_64:
    rust-debuginfo-1.99.1-1.amzn2023.x86_64
    rust-analyzer-debuginfo-1.99.1-1.amzn2023.x86_64
    cargo-debuginfo-1.99.1-1.amzn2023.x86_64
    rust-std-static-1.99.1-1.amzn2023.x86_64
    rust-1.99.1-1.amzn2023.x86_64
    rustfmt-debuginfo-1.99.1-1.amzn2023.x86_64
    rust-debugsource-1.99.1-1.amzn2023.x86_64
    clippy-debuginfo-1.99.1-1.amzn2023.x86_64
    rustfmt-1.99.1-1.amzn2023.x86_64
    clippy-1.99.1-1.amzn2023.x86_64
    rust-analyzer-1.99.1-1.amzn2023.x86_64
    cargo-1.99.1-1.amzn2023.x86_64
    rust-doc-1.99.1-1.amzn2023.x86_64