Описание
Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues:
- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).
- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276994).
Changes for amazon-ssm-agent:
- Update to version 3.3.5226.0
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
SUSE Linux Enterprise Module for Public Cloud 15 SP6
SUSE Linux Enterprise Module for Public Cloud 15 SP7
Ссылки
- Link for SUSE-SU-2026:4082-1
- E-Mail link for SUSE-SU-2026:4082-1
- SUSE Security Ratings
- SUSE Bug 1276981
- SUSE Bug 1276994
- SUSE CVE CVE-2026-71556 page
- SUSE CVE CVE-2026-71557 page
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Затронутые продукты
Ссылки
- CVE-2026-71556
- SUSE Bug 1276977
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-71557
- SUSE Bug 1276986