diff mbox series

[scarthgap,13/27] python3-git: fix CVE-2026-73619

Message ID 20261016061922.843414-14-yurade@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series python3-git: Security fixes | expand

Commit Message

Yogita Urade Oct. 16, 2026, 6:19 a.m. UTC 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca
[2] https://www.cve.org/CVERecord?id=CVE-2026-73619

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
 .../python/python3-git/CVE-2026-73619.patch   | 59 +++++++++++++++++++
 .../python/python3-git_3.1.42.bb              |  1 +
 2 files changed, 60 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch
new file mode 100644
index 0000000000..9ef25fd959
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch
@@ -0,0 +1,59 @@ 
+From 03c9b0fc2530fb81d15bf3f41f39da7e2308289c Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Sun, 26 Jul 2026 06:00:59 +0200
+Subject: [PATCH 21/38] Block unsafe archive additions and bundle URI
+
+GHSA-539m-9xh6-q6rr reports incomplete unsafe option lists for archive inputs
+and clone bundle URLs. Caller-controlled archive additions can expose or inject
+filesystem content, while clone --bundle-uri can dereference an additional
+caller-controlled URL.
+
+Extend the existing archive denylist with --add-file and --add-virtual-file,
+and the clone denylist with --bundle-uri. Regression coverage exercises archive
+kwargs plus both clone multi-option and keyword paths.
+
+Git baseline: a23bace963d508bd96983cc637131392d3face18.
+Documentation/git-archive.adoc defines --add-file/--add-virtual-file, and
+Documentation/git-clone.adoc defines --bundle-uri as fetching from the supplied
+URI.
+
+CVE: CVE-2026-73619
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI 
+  source archive does not include its test suite.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/repo/base.py |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/git/repo/base.py b/git/repo/base.py
+index 0d4fae8a..7142f220 100644
+--- a/git/repo/base.py
++++ b/git/repo/base.py
+@@ -142,6 +142,8 @@ class Repo:
+         "-c",
+         # Can install hooks that execute during clone:
+         "--template",
++        # Fetches from a caller-controlled URL:
++        "--bundle-uri",
+     ]
+     """Options to ``git clone`` that allow arbitrary commands to be executed.
+ 
+@@ -163,6 +165,10 @@ class Repo:
+         # Writes output to a caller-controlled filesystem path.
+         "--output",
+         "-o",
++        # Reads from a caller-controlled filesystem path:
++        "--add-file",
++        # Injects a caller-controlled path and contents:
++        "--add-virtual-file",
+     ]
+ 
+     unsafe_git_revision_options = [
+-- 
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb
index 3f04fe8fdb..c2fbc65db2 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.42.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb
@@ -34,6 +34,7 @@  SRC_URI += "            file://CVE-2026-42284.patch \
             file://CVE-2026-73622.patch \
             file://CVE-2026-73621.patch \
             file://CVE-2026-73620.patch \
+            file://CVE-2026-73619.patch \
            "
 SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"