SB2026090865 - SUSE update for amazon-ssm-agent
Published: September 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Link following (CVE-ID: CVE-2026-71556)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify files outside the intended worktree path.
The vulnerability exists due to improper link resolution before file access in the worktree filesystem wrapper when performing worktree file operations on attacker-controlled symbolic link paths. A remote attacker can introduce a symbolic link in the worktree and cause the application to perform a write through that path to modify files outside the intended worktree path.
User interaction is required, and exploitation requires the attacker to be able to introduce or control a symbolic link in the worktree.
2) Path traversal (CVE-ID: CVE-2026-71557)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify files outside the intended reference storage.
The vulnerability exists due to path traversal in the `storage/filesystem` package `dotgit` reference storage when processing attacker-controlled reference names during clone or fetch operations. A remote user can advertise a specially crafted reference name to modify files outside the intended reference storage.
This affects filesystem-backed repositories, while instances using only the in-memory `storage/memory` implementation are not affected. User interaction is required for an application using filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.
Remediation
Install update from vendor's website.