new file mode 100644
@@ -0,0 +1,50 @@
+From 2375813d552210675950e73cbdad1baec3be8d74 Mon Sep 17 00:00:00 2001
+From: abhiprd2000 <8292aniarc@gmail.com>
+Date: Thu, 9 Jul 2026 21:22:50 +0530
+Subject: [PATCH 09/38] Reject abbreviated forms of unsafe git options
+
+CVE: CVE-2026-67325
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f]
+
+Backport Changes:
+- Omit upstream regression test changes because the current
+ PyPI source archive does not include its test suite.
+
+(cherry picked from commit 2ab051697940144545a14d2f4a639c6409c3187f)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index c09d47ba..e965c586 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -563,13 +563,20 @@ class Git(LazyMixin):
+ arbitrary commands, this are blocked by default.
+ """
+ # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
++ # Git accepts any unambiguous prefix of a long option, so an abbreviated
++ # spelling such as `--upl` for `--upload-pack` must be rejected too. An
++ # option is unsafe if its canonical name is a prefix of any blocked
++ # option's canonical name.
+ canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+ for option in options:
+- unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+- if unsafe_option is not None:
+- raise UnsafeOptionError(
+- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+- )
++ candidate = cls._canonicalize_option_name(option)
++ if not candidate:
++ continue
++ for canonical, unsafe_option in canonical_unsafe_options.items():
++ if canonical.startswith(candidate):
++ raise UnsafeOptionError(
++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
++ )
+
+ class AutoInterrupt:
+ """Process wrapper that terminates the wrapped process on finalization.
+--
+2.35.6
new file mode 100644
@@ -0,0 +1,53 @@
+From de30c364114907e1cb240ea8ce0e7aadd9ef32b2 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Sun, 12 Jul 2026 13:45:42 +0200
+Subject: [PATCH 10/38] Address review feedback about unsafe option
+ abbreviations
+
+The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs.
+
+This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected.
+
+Reviewd-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+
+CVE: CVE-2026-67325
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63]
+
+Backport Changes:
+- Omit upstream regression test changes because the current
+ PyPI source archive does not include its test suite.
+
+(cherry picked from commit 181e8ede7543dbbdcee92756cea260f675316c63)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index e965c586..8e8cd0c5 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -566,12 +566,20 @@ class Git(LazyMixin):
+ # Git accepts any unambiguous prefix of a long option, so an abbreviated
+ # spelling such as `--upl` for `--upload-pack` must be rejected too. An
+ # option is unsafe if its canonical name is a prefix of any blocked
+- # option's canonical name.
++ # option's canonical name. Only long options and multi-character kwargs
++ # can be abbreviations; single-character short options remain exact-match
++ # only.
+ canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
++ options_are_kwargs = all(not option.startswith("-") for option in options)
+ for option in options:
+ candidate = cls._canonicalize_option_name(option)
+ if not candidate:
+ continue
++ unsafe_option = canonical_unsafe_options.get(candidate)
++ if unsafe_option is not None:
++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
++ if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)):
++ continue
+ for canonical, unsafe_option in canonical_unsafe_options.items():
+ if canonical.startswith(candidate):
+ raise UnsafeOptionError(
+--
+2.35.6
@@ -23,6 +23,8 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-42215_p2.patch \
file://CVE-2026-67326.patch \
file://CVE-2026-67323.patch \
+ file://CVE-2026-67325_p1.patch \
+ file://CVE-2026-67325_p2.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f [2] https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63 [3] https://www.cve.org/CVERecord?id=CVE-2026-67325 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-git/CVE-2026-67325_p1.patch | 50 +++++++++++++++++ .../python3-git/CVE-2026-67325_p2.patch | 53 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 2 + 3 files changed, 105 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch