diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch new file mode 100644 index 0000000000..336460817a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch @@ -0,0 +1,108 @@ +From 8d534d0df8f00033c02e281291e39ed3b26f7690 Mon Sep 17 00:00:00 2001 +From: "GPT 5.5" +Date: Tue, 5 May 2026 21:34:42 +0800 +Subject: [PATCH 08/38] Validate config key section names before writing + +GitConfigParser already rejected CR, LF, and NUL in config values before +writing, but section and option names could still reach configparser. Because +GitPython writes section headers itself, a newline-bearing section name could +split the output into additional headers. + +Reject CR, LF, and NUL in section and option names on write paths that create +or set config keys: add_section(), set(), set_value(), add_value(), and +rename_section() destinations. This matches Git config key validation behavior; +Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys +containing newlines from config.c, and local git 2.50.1 rejects newline-bearing +config keys. + +Add a regression test covering unsafe section and option names while preserving +safe writes. + +CVE: CVE-2026-67326 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06] + +Backport Changes: +- Omit upstream regression test changes because the Scarthgap PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 54538428f79b0c91ba52cda5229856a6edf7ac06) +Signed-off-by: Yogita Urade +--- + git/config.py | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index 7988f5d9..1df1415f 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -71,6 +71,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr + See: https://git-scm.com/docs/git-config#_conditional_includes + """ + ++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ++"""Characters that cannot be safely written in config names or values.""" ++ + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 + """Utility class wrapping base-class methods into decorators that assure read-only properties.""" +@@ -741,6 +744,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def add_section(self, section: str) -> None: + """Assures added options will stay in order""" ++ self._assure_config_name_safe(section, "section") + return super().add_section(section) + + @property +@@ -843,10 +847,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: + value_str = self._value_to_string(value) +- if re.search(r"[\r\n\x00]", value_str): ++ if UNSAFE_CONFIG_CHARS_RE.search(value_str): + raise ValueError("Git config values must not contain CR, LF, or NUL") + return value_str + ++ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: ++ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): ++ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ + @needs_values + @set_dirty_and_flush_changes + def set( +@@ -855,6 +863,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + option: str, + value: Union[str, bytes, int, float, bool, None] = None, + ) -> None: ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + if value is not None: + value = self._value_to_string_safe(value) + return super().set(section, option, value) +@@ -873,6 +883,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + a string. + :return: This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -894,6 +906,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + to a string + :return: This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -909,6 +923,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + """ + if not self.has_section(section): + raise ValueError("Source section '%s' doesn't exist" % section) ++ self._assure_config_name_safe(new_name, "section") + if self.has_section(new_name): + raise ValueError("Destination section '%s' already exists" % new_name) + +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 38fbd8a078..1ba34dbf52 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -14,13 +14,14 @@ CVE_PRODUCT = "gitpython_project:gitpython" inherit pypi python_setuptools_build_meta -SRC_URI += "file://CVE-2026-42284.patch \ +SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-44243_p1.patch \ file://CVE-2026-44243_p2.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-42215_p1.patch \ file://CVE-2026-42215_p2.patch \ + file://CVE-2026-67326.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"