new file mode 100644
@@ -0,0 +1,108 @@
+From 8d534d0df8f00033c02e281291e39ed3b26f7690 Mon Sep 17 00:00:00 2001
+From: "GPT 5.5" <codex@openai.com>
+Date: Tue, 5 May 2026 21:34:42 +0800
+Subject: [PATCH 08/38] Validate config key section names before writing
+
+GitConfigParser already rejected CR, LF, and NUL in config values before
+writing, but section and option names could still reach configparser. Because
+GitPython writes section headers itself, a newline-bearing section name could
+split the output into additional headers.
+
+Reject CR, LF, and NUL in section and option names on write paths that create
+or set config keys: add_section(), set(), set_value(), add_value(), and
+rename_section() destinations. This matches Git config key validation behavior;
+Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys
+containing newlines from config.c, and local git 2.50.1 rejects newline-bearing
+config keys.
+
+Add a regression test covering unsafe section and option names while preserving
+safe writes.
+
+CVE: CVE-2026-67326
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06]
+
+Backport Changes:
+- Omit upstream regression test changes because the Scarthgap PyPI source archive does not include its test suite.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 54538428f79b0c91ba52cda5229856a6edf7ac06)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/git/config.py b/git/config.py
+index 7988f5d9..1df1415f 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -71,6 +71,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr
+ See: https://git-scm.com/docs/git-config#_conditional_includes
+ """
+
++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")
++"""Characters that cannot be safely written in config names or values."""
++
+
+ class MetaParserBuilder(abc.ABCMeta): # noqa: B024
+ """Utility class wrapping base-class methods into decorators that assure read-only properties."""
+@@ -741,6 +744,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+
+ def add_section(self, section: str) -> None:
+ """Assures added options will stay in order"""
++ self._assure_config_name_safe(section, "section")
+ return super().add_section(section)
+
+ @property
+@@ -843,10 +847,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+
+ def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str:
+ value_str = self._value_to_string(value)
+- if re.search(r"[\r\n\x00]", value_str):
++ if UNSAFE_CONFIG_CHARS_RE.search(value_str):
+ raise ValueError("Git config values must not contain CR, LF, or NUL")
+ return value_str
+
++ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
++ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
++ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++
+ @needs_values
+ @set_dirty_and_flush_changes
+ def set(
+@@ -855,6 +863,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ option: str,
+ value: Union[str, bytes, int, float, bool, None] = None,
+ ) -> None:
++ self._assure_config_name_safe(section, "section")
++ self._assure_config_name_safe(option, "option")
+ if value is not None:
+ value = self._value_to_string_safe(value)
+ return super().set(section, option, value)
+@@ -873,6 +883,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ a string.
+ :return: This instance
+ """
++ self._assure_config_name_safe(section, "section")
++ self._assure_config_name_safe(option, "option")
+ value_str = self._value_to_string_safe(value)
+ if not self.has_section(section):
+ self.add_section(section)
+@@ -894,6 +906,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ to a string
+ :return: This instance
+ """
++ self._assure_config_name_safe(section, "section")
++ self._assure_config_name_safe(option, "option")
+ value_str = self._value_to_string_safe(value)
+ if not self.has_section(section):
+ self.add_section(section)
+@@ -909,6 +923,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ """
+ if not self.has_section(section):
+ raise ValueError("Source section '%s' doesn't exist" % section)
++ self._assure_config_name_safe(new_name, "section")
+ if self.has_section(new_name):
+ raise ValueError("Destination section '%s' already exists" % new_name)
+
+--
+2.35.6
@@ -14,13 +14,14 @@ CVE_PRODUCT = "gitpython_project:gitpython"
inherit pypi python_setuptools_build_meta
-SRC_URI += "file://CVE-2026-42284.patch \
+SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-44243_p1.patch \
file://CVE-2026-44243_p2.patch \
file://CVE-2026-44244_p1.patch \
file://CVE-2026-44244_p2.patch \
file://CVE-2026-42215_p1.patch \
file://CVE-2026-42215_p2.patch \
+ file://CVE-2026-67326.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06 [2] https://www.cve.org/CVERecord?id=CVE-2026-67326 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-67326.patch | 108 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 3 +- 2 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch