[wrynose,v2,00/27] python3-git: Security fixes

Message ID	20261106144331.3354811-1-yurade@cisco.com
Headers	show Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7518.1793976213994639424 for <openembedded-core@lists.openembedded.org>; Fri, 06 Nov 2026 06:43:34 -0800 ip: 173.37.86.75, mailfrom: yurade@cisco.com) IronPort-Data: A9a23:ODSBKKmU4xbeEQbbrYBfhLro5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJLUTqBaP6CajHwc4sgYdvg/UsHsJbQndVqTlRur3o8EFtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FbUh9sUqUV5wz 6MnC3craTuSoNuXkJvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMmbBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZT/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYaII4XbHpQO9qqej mXeuELlPk0ZD4ea1GCq4HiUluPtwRquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:TsyGsa5Aj/o5x6HbWgPXwPjXdLJyesId70hD6qkXc202TiX2ra 6TdZgguCMc6wxhO03I5+rgBEDoexq1nvRICOIqUotKMjOLhILRFuFfxLqn5SH8ECvj8eMY/6 Jhf69iTODUNzFB/KPHCM3SKadG/DFBm5rY4dvj8w== From: Yogita Urade <yurade@cisco.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 00/27] python3-git: Security fixes Date: Fri, 6 Nov 2026 06:43:04 -0800 Message-Id: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8"
Series	python3-git: Security fixes \| expand [wrynose,v2,00/27] python3-git: Security fixes [wrynose,v2,01/27] python3-git: fix CVE-2026-67326 [wrynose,v2,02/27] python3-git: fix CVE-2026-67323 [wrynose,v2,03/27] python3-git: Fix CVE-2026-67325 [wrynose,v2,04/27] python3-git: fix CVE-2026-67324 [wrynose,v2,05/27] python3-git: fix CVE-2026-67322 [wrynose,v2,06/27] python3-git: fix CVE-2026-69097 [wrynose,v2,07/27] python3-git: fix CVE-2026-73625 [wrynose,v2,08/27] python3-git: fix CVE-2026-73623 [wrynose,v2,09/27] python3-git: fix CVE-2026-73624 [wrynose,v2,10/27] python3-git: fix CVE-2026-73622 [wrynose,v2,11/27] python3-git: fix CVE-2026-73621 [wrynose,v2,12/27] python3-git: fix CVE-2026-73620 [wrynose,v2,13/27] python3-git: fix CVE-2026-73619 [wrynose,v2,14/27] python3-git: fix CVE-2026-76221 [wrynose,v2,15/27] python3-git: fix CVE-2026-76220 [wrynose,v2,16/27] python3-git: fix CVE-2026-76219 [wrynose,v2,17/27] python3-git: fix CVE-2026-76218 [wrynose,v2,18/27] python3-git: fix CVE-2026-76217 [wrynose,v2,19/27] python3-git: fix CVE-2026-76222 [wrynose,v2,20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679 [wrynose,v2,21/27] python3-git: fix CVE-2026-78677 [wrynose,v2,22/27] python3-git: fix CVE-2026-78676 [wrynose,v2,23/27] python3-git: fix CVE-2026-78675 [wrynose,v2,24/27] python3-git: fix CVE-2026-87817 [wrynose,v2,25/27] python3-git: fix CVE-2026-87818 [wrynose,v2,26/27] python3-git: Fix CVE-2026-87819 [wrynose,v2,27/27] python3-git: fix CVE-2026-100689

Message ID

20261106144331.3354811-1-yurade@cisco.com

Headers

IronPort-Data: A9a23:ODSBKKmU4xbeEQbbrYBfhLro5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt
 xJLUTqBaP6CajHwc4sgYdvg/UsHsJbQndVqTlRur3o8EFtH+JHPbTi7wugcHM8zwunrFh8PA
 xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k
 Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb
 /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ
 OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FbUh9sUqUV5wz
 6MnC3craTuSoNuXkJvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMmbBa7L/tRfmjw3g6iiH96HO
 JFfMmUpNkmdJUQTZT/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYaII4XbHpQO9qqej
 mXeuELlPk0ZD4ea1GCq4HiUluPtwRquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L
 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36
 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/
IronPort-HdrOrdr: A9a23:TsyGsa5Aj/o5x6HbWgPXwPjXdLJyesId70hD6qkXc202TiX2ra
 6TdZgguCMc6wxhO03I5+rgBEDoexq1nvRICOIqUotKMjOLhILRFuFfxLqn5SH8ECvj8eMY/6
 Jhf69iTODUNzFB/KPHCM3SKadG/DFBm5rY4dvj8w==
From: Yogita Urade <yurade@cisco.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][wrynose][v2 PATCH 00/27] python3-git: Security fixes
Date: Fri,  6 Nov 2026 06:43:04 -0800
Message-Id: <20261106144331.3354811-1-yurade@cisco.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="utf-8"

Series

python3-git: Security fixes | expand

Message

Yogita Urade Nov. 6, 2026, 2:43 p.m. UTC

Backport 27 GitPython security fixes covering 28 CVEs to the python3-git
3.1.43 recipe on wrynose. The series adds the fixes as patches and updates
the recipe to apply them.

CVE-2026-78678 and CVE-2026-78679 are addressed together. The CVE-2026-76222
fix includes a regression correction and follow-up patch, CVE-2026-73619
and CVE-2026-87819 are each carried in two patches. The patches retain
upstream references.

Changes in v2:
- Re-reviewed all patches and removed changes that were not needed for the backports.
- Restored upstream commit metadata and corrected CVE references.
- Updated Backport Changes notes to describe the differences from upstream.
- Removed trailing whitespace and regenerated the series diffstat.

Yogita Urade (27):
  python3-git: fix CVE-2026-67326
  python3-git: fix CVE-2026-67323
  python3-git: Fix CVE-2026-67325
  python3-git: Fix CVE-2026-67324
  python3-git: fix CVE-2026-67322
  python3-git: fix CVE-2026-69097
  python3-git: fix CVE-2026-73625
  python3-git: fix CVE-2026-73623
  python3-git: fix CVE-2026-73624
  python3-git: fix CVE-2026-73622
  python3-git: fix CVE-2026-73621
  python3-git: fix CVE-2026-73620
  python3-git: fix CVE-2026-73619
  python3-git: fix CVE-2026-76221
  python3-git: fix CVE-2026-76220
  python3-git: fix CVE-2026-76219
  python3-git: fix CVE-2026-76218
  python3-git: fix CVE-2026-76217
  python3-git: fix CVE-2026-76222
  python3-git: fix CVE-2026-78678 CVE-2026-78679
  python3-git: fix CVE-2026-78677
  python3-git: fix CVE-2026-78676
  python3-git: fix CVE-2026-78675
  python3-git: fix CVE-2026-87817
  python3-git: fix CVE-2026-87818
  python3-git: Fix CVE-2026-87819
  python3-git: fix CVE-2026-100689

 .../python/python3-git/CVE-2026-100689.patch       |  91 +++++
 .../python/python3-git/CVE-2026-67322.patch        | 171 ++++++++
 .../python/python3-git/CVE-2026-67323.patch        | 356 +++++++++++++++++
 .../python/python3-git/CVE-2026-67324.patch        |  94 +++++
 .../python/python3-git/CVE-2026-67325_p1.patch     |  49 +++
 .../python/python3-git/CVE-2026-67325_p2.patch     |  52 +++
 .../python/python3-git/CVE-2026-67326.patch        | 107 +++++
 .../python/python3-git/CVE-2026-69097.patch        |  60 +++
 .../python/python3-git/CVE-2026-73619_p1.patch     |  58 +++
 .../python/python3-git/CVE-2026-73619_p2.patch     |  43 ++
 .../python/python3-git/CVE-2026-73620.patch        | 130 ++++++
 .../python/python3-git/CVE-2026-73621.patch        |  72 ++++
 .../python/python3-git/CVE-2026-73622.patch        |  60 +++
 .../python/python3-git/CVE-2026-73623.patch        |  53 +++
 .../python/python3-git/CVE-2026-73624.patch        | 139 +++++++
 .../python/python3-git/CVE-2026-73625.patch        |  59 +++
 .../python/python3-git/CVE-2026-76217.patch        | 179 +++++++++
 .../python/python3-git/CVE-2026-76218.patch        |  92 +++++
 .../python/python3-git/CVE-2026-76219.patch        | 153 +++++++
 .../python/python3-git/CVE-2026-76220.patch        |  65 +++
 .../python/python3-git/CVE-2026-76221.patch        |  59 +++
 .../python3-git/CVE-2026-76222-regression.patch    |  39 ++
 .../python/python3-git/CVE-2026-76222_p1.patch     | 118 ++++++
 .../python/python3-git/CVE-2026-76222_p2.patch     |  45 +++
 .../python/python3-git/CVE-2026-78675.patch        |  47 +++
 .../python/python3-git/CVE-2026-78676.patch        |  67 ++++
 .../python/python3-git/CVE-2026-78677.patch        |  87 ++++
 .../CVE-2026-78678_CVE-2026-78679.patch            | 220 ++++++++++
 .../python/python3-git/CVE-2026-87817.patch        | 443 +++++++++++++++++++++
 .../python/python3-git/CVE-2026-87818.patch        |  55 +++
 .../python/python3-git/CVE-2026-87819_p1.patch     |  78 ++++
 .../python/python3-git/CVE-2026-87819_p2.patch     | 146 +++++++
 meta/recipes-devtools/python/python3-git_3.1.43.bb |  32 ++
 33 files changed, 3519 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch