[scarthgap,00/27] python3-git: Security fixes

Message ID	20261016061922.843414-1-yurade@cisco.com
Headers	show Return-Path: <yurade@cisco.com> ip: 173.37.86.74, mailfrom: yurade@cisco.com) IronPort-Data: A9a23:+ZNVE6KZp78dVcIRFE+RhpQlxSXFcZb7ZxGr2PjKsXjdYENSgjMOz 2YWXG3QO/2CZGDyc9wga4mwpBsGvZaEz4dgHQod+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1iMXNxMr8jw99KLjh/z PsmEncDUQi60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MESojx5nYj/7DLovgf2hinTXeDxDo1XTrq0yi4TW5FEqjue3aoWPJLRmQ+1PwR+Zu mTqpl2lEzoKM9+Glhmi1HWj07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/ONpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOb9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:UuNySqBzIWs1uKnlHemc55DYdb4zR+YMi2TDsHoBKyC9Hfb3qy nDppkmPHzP+VUssQ8b+OxoUZPoKRi3yXcf2+Ys1NmZMDUOwFHJEKhSqa3/3jbnByryssRZ1a tmbuxCLeeYNykesS4/izPIdOrJB7K8gcSVuds= From: Yogita Urade <yurade@cisco.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 00/27] python3-git: Security fixes Date: Thu, 15 Oct 2026 23:18:55 -0700 Message-Id: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	python3-git: Security fixes \| expand [scarthgap,00/27] python3-git: Security fixes [scarthgap,01/27] python3-git: fix CVE-2026-67326 [scarthgap,02/27] python3-git: Fix CVE-2026-67323 [scarthgap,03/27] python3-git: fix CVE-2026-67325 [scarthgap,04/27] python3-git: fix CVE-2026-67324 [scarthgap,05/27] python3-git: fix CVE-2026-67322 [scarthgap,06/27] python3-git: fix CVE-2026-69097 [scarthgap,07/27] python3-git: fix CVE-2026-73625 [scarthgap,08/27] python3-git: fix CVE-2026-73623 [scarthgap,09/27] python3-git: fix CVE-2026-73624 [scarthgap,10/27] python3-git: fix CVE-2026-73622 [scarthgap,11/27] python3-git: fix CVE-2026-73621 [scarthgap,12/27] python3-git: fix CVE-2026-73620 [scarthgap,13/27] python3-git: fix CVE-2026-73619 [scarthgap,14/27] python3-git: fix CVE-2026-76221 [scarthgap,15/27] python3-git: fix CVE-2026-76220 [scarthgap,16/27] python3-git: fix CVE-2026-76219 [scarthgap,17/27] python3-git: fix CVE-2026-76218 [scarthgap,18/27] python3-git: fix CVE-2026-76217 [scarthgap,19/27] python3-git: fix CVE-2026-76222 [scarthgap,20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679 [scarthgap,21/27] python3-git: fix CVE-2026-78677 [scarthgap,22/27] python3-git: fix CVE-2026-78676 [scarthgap,23/27] python3-git: fix CVE-2026-78675 [scarthgap,24/27] python3-git: fix CVE-2026-87817 [scarthgap,25/27] python3-git: fix CVE-2026-87818 [scarthgap,26/27] python3-git: fix CVE-2026-87819 [scarthgap,27/27] python3-git: fix CVE-2026-100689

Message ID

20261016061922.843414-1-yurade@cisco.com

Headers

IronPort-Data: A9a23:+ZNVE6KZp78dVcIRFE+RhpQlxSXFcZb7ZxGr2PjKsXjdYENSgjMOz
 2YWXG3QO/2CZGDyc9wga4mwpBsGvZaEz4dgHQod+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t
 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0
 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T
 vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/
 /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1iMXNxMr8jw99KLjh/z
 PsmEncDUQi60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI
 ZBENHw2MESojx5nYj/7DLovgf2hinTXeDxDo1XTrq0yi4TW5FEqjue3aoWPJLRmQ+1PwR+Zu
 mTqpl2lEzoKM9+Glhmi1HWj07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb
 UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/ONpQ2YHWMDCDVGbbTKqfMLeNDj7
 XfR9/uBONClmOb9pa61nltMkQ6PBA==
IronPort-HdrOrdr: A9a23:UuNySqBzIWs1uKnlHemc55DYdb4zR+YMi2TDsHoBKyC9Hfb3qy
 nDppkmPHzP+VUssQ8b+OxoUZPoKRi3yXcf2+Ys1NmZMDUOwFHJEKhSqa3/3jbnByryssRZ1a
 tmbuxCLeeYNykesS4/izPIdOrJB7K8gcSVuds=
From: Yogita Urade <yurade@cisco.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap][PATCH 00/27] python3-git: Security fixes
Date: Thu, 15 Oct 2026 23:18:55 -0700
Message-Id: <20261016061922.843414-1-yurade@cisco.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

python3-git: Security fixes | expand

Message

Yogita Urade Oct. 16, 2026, 6:18 a.m. UTC

Backport GitPython security fixes to the Scarthgap python3-git 3.1.42
recipe. The 27-patch series covers 28 CVE IDs and hardens Git option
validation, config parsing and serialization, submodule paths, repository
discovery, and actor parsing.

The CVE-2026-76222 and CVE-2026-87819 fixes retain their ordered upstream
follow-up changes. Patch 0020 carries the shared upstream hardening for
CVE-2026-78678 and CVE-2026-78679.

Yogita Urade (27):
  python3-git: fix CVE-2026-67326
  python3-git: Fix CVE-2026-67323
  python3-git: fix CVE-2026-67325
  python3-git: fix CVE-2026-67324
  python3-git: fix CVE-2026-67322
  python3-git: fix CVE-2026-69097
  python3-git: fix CVE-2026-73625
  python3-git: fix CVE-2026-73623
  python3-git: fix CVE-2026-73624
  python3-git: fix CVE-2026-73622
  python3-git: fix CVE-2026-73621
  python3-git: fix CVE-2026-73620
  python3-git: fix CVE-2026-73619
  python3-git: fix CVE-2026-76221
  python3-git: fix CVE-2026-76220
  python3-git: fix CVE-2026-76219
  python3-git: fix CVE-2026-76218
  python3-git: fix CVE-2026-76217
  python3-git: fix CVE-2026-76222
  python3-git: fix CVE-2026-78678 CVE-2026-78679
  python3-git: fix CVE-2026-78677
  python3-git: fix CVE-2026-78676
  python3-git: fix CVE-2026-78675
  python3-git: fix CVE-2026-87817
  python3-git: fix CVE-2026-87818
  python3-git: fix CVE-2026-87819
  python3-git: fix CVE-2026-100689

 .../python/python3-git/CVE-2026-100689.patch  |  60 +++
 .../python/python3-git/CVE-2026-67322.patch   | 174 +++++++
 .../python/python3-git/CVE-2026-67323.patch   | 346 ++++++++++++++
 .../python/python3-git/CVE-2026-67324.patch   | 102 +++++
 .../python3-git/CVE-2026-67325_p1.patch       |  50 ++
 .../python3-git/CVE-2026-67325_p2.patch       |  53 +++
 .../python/python3-git/CVE-2026-67326.patch   | 108 +++++
 .../python/python3-git/CVE-2026-69097.patch   |  61 +++
 .../python/python3-git/CVE-2026-73619.patch   |  59 +++
 .../python/python3-git/CVE-2026-73620.patch   | 130 ++++++
 .../python/python3-git/CVE-2026-73621.patch   |  76 ++++
 .../python/python3-git/CVE-2026-73622.patch   |  61 +++
 .../python/python3-git/CVE-2026-73623.patch   |  54 +++
 .../python/python3-git/CVE-2026-73624.patch   | 135 ++++++
 .../python/python3-git/CVE-2026-73625.patch   |  68 +++
 .../python/python3-git/CVE-2026-76217.patch   | 173 +++++++
 .../python/python3-git/CVE-2026-76218.patch   |  91 ++++
 .../python/python3-git/CVE-2026-76219.patch   | 166 +++++++
 .../python/python3-git/CVE-2026-76220.patch   |  66 +++
 .../python/python3-git/CVE-2026-76221.patch   |  61 +++
 .../CVE-2026-76222-regression.patch           |  35 ++
 .../python3-git/CVE-2026-76222_p1.patch       | 123 +++++
 .../python3-git/CVE-2026-76222_p2.patch       |  49 ++
 .../python/python3-git/CVE-2026-78675.patch   |  49 ++
 .../python/python3-git/CVE-2026-78676.patch   |  55 +++
 .../python/python3-git/CVE-2026-78677.patch   |  87 ++++
 .../CVE-2026-78678_CVE-2026-78679.patch       | 208 +++++++++
 .../python/python3-git/CVE-2026-87817.patch   | 430 ++++++++++++++++++
 .../python/python3-git/CVE-2026-87818.patch   |  56 +++
 .../python3-git/CVE-2026-87819_p1.patch       |  78 ++++
 .../python3-git/CVE-2026-87819_p2.patch       |  58 +++
 .../python/python3-git_3.1.42.bb              |  33 +-
 32 files changed, 3354 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch