diff mbox series

[wrynose,10/27] python3-git: fix CVE-2026-73622

Message ID 20261016054106.210444-11-yurade@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series python3-git: Security fixes | expand

Commit Message

Yogita Urade Oct. 16, 2026, 5:40 a.m. UTC 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-73622

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
 .../python/python3-git/CVE-2026-73622.patch   | 60 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch
new file mode 100644
index 0000000000..c43013b9e4
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch
@@ -0,0 +1,60 @@ 
+From 5043b75a697c0f9110d2014234831dd1bc568a60 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Wed, 22 Jul 2026 15:42:44 +0200
+Subject: [PATCH] fix: prevent environment expansion in remote URLs
+
+Remote and submodule creation expanded environment-variable references in
+caller-supplied URLs before storing them in Git configuration. This could
+expose process environment values through a later network request or a tracked
+.gitmodules file.
+
+Preserve variables literally in the remaining untrusted URL callers while
+retaining Git.polish_url() expansion for intentional local-path normalization.
+Add regression tests covering remote configuration and submodule configuration.
+
+Git baseline: git remote add and git submodule add accept URL arguments
+literally; Git does not perform shell-style environment expansion on those
+arguments.
+
+CVE: CVE-2026-73622
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162]
+
+Backport Changes:
+- Omitted test/test_remote.py, test/test_submodule.py because the current 
+  PyPI source archive does not include the test suite and the python3-git 
+  recipe does not run it.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 863417457a0633db7ea5aed4fd01e0b291a41162)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/submodule/base.py | 2 +-
+ git/remote.py                 | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py
+index fa60bcda..43e0ec9a 100644
+--- a/git/objects/submodule/base.py
++++ b/git/objects/submodule/base.py
+@@ -601,7 +601,7 @@ class Submodule(IndexObject, TraversableIterableObj):
+         # END verify url
+ 
+         ## See #525 for ensuring git URLs in config-files are valid under Windows.
+-        url = Git.polish_url(url)
++        url = Git.polish_url(url, expand_vars=False)
+ 
+         # It's important to add the URL to the parent config, to let `git submodule` know.
+         # Otherwise there is a '-' character in front of the submodule listing:
+diff --git a/git/remote.py b/git/remote.py
+index cafa1f84..dd892fdc 100644
+--- a/git/remote.py
++++ b/git/remote.py
+@@ -805,7 +805,7 @@ class Remote(LazyMixin, IterableObj):
+         """
+         scmd = "add"
+         kwargs["insert_kwargs_after"] = scmd
+-        url = Git.polish_url(url)
++        url = Git.polish_url(url, expand_vars=False)
+         if not allow_unsafe_protocols:
+             Git.check_unsafe_protocols(url)
+         repo.git.remote(scmd, "--", name, url, **kwargs)
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 847bdfeab2..6456031620 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -31,6 +31,7 @@  SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-73625.patch \
            file://CVE-2026-73623.patch \
            file://CVE-2026-73624.patch \
+           file://CVE-2026-73622.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"