diff mbox series

[scarthgap,06/27] python3-git: fix CVE-2026-69097

Message ID 20261016061922.843414-7-yurade@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series python3-git: Security fixes | expand

Commit Message

Yogita Urade Oct. 16, 2026, 6:19 a.m. UTC 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1
[2] https://www.cve.org/CVERecord?id=CVE-2026-69097

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
 .../python/python3-git/CVE-2026-69097.patch   | 61 +++++++++++++++++++
 .../python/python3-git_3.1.42.bb              |  1 +
 2 files changed, 62 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
new file mode 100644
index 0000000000..9d472d3358
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
@@ -0,0 +1,61 @@ 
+From 128f8da8dac072f61427b5bf7801173915d69b85 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Mon, 20 Jul 2026 14:13:22 +0200
+Subject: [PATCH 14/38] fix: validate config section delimiters
+
+GHSA-3rp5-jjmw-4wv2 identified that configuration section names could alter the
+structure of serialized config despite the existing control-character checks.
+
+Reject unquoted closing section delimiters across all writer entry points
+while preserving valid delimiters inside quoted subsections and the
+existing option-name behavior. Add regression coverage for unsafe plain and
+quoted-subsection-shaped names as well as a valid quoted subsection.
+
+Git baseline: a23bace963d508bd96983cc637131392d3face18. Git config parsing
+treats an unquoted closing bracket as the end of a basic section header, while
+its extended form permits brackets inside a quoted subsection and requires a
+final bracket after the closing quote.
+
+CVE: CVE-2026-69097
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1]
+
+Backport Changes:
+- Omit upstream regression test changes because the current 
+  PyPI source archive does not include its test suite.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f1)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py |   16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/git/config.py b/git/config.py
+index 1df1415f..3015bb73 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -854,6 +854,22 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+     def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
+         if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
+             raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++        if label == "section" and isinstance(name, str):
++            in_quotes = False
++            escaped = False
++            for index, char in enumerate(name):
++                if escaped:
++                    escaped = False
++                elif in_quotes and char == "\\":
++                    escaped = True
++                elif char == '"':
++                    if not in_quotes and (index == 0 or name[index - 1] not in " \t"):
++                        raise ValueError("Git config quoted subsection names must begin after whitespace")
++                    in_quotes = not in_quotes
++                elif char == "]" and not in_quotes:
++                    raise ValueError("Git config section names must not contain an unquoted closing bracket")
++            if in_quotes:
++                raise ValueError("Git config section names must not contain an unterminated quote")
+ 
+     @needs_values
+     @set_dirty_and_flush_changes
+-- 
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb
index cbfdb5e757..c5cefeaee8 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.42.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb
@@ -27,6 +27,7 @@  SRC_URI += "            file://CVE-2026-42284.patch \
             file://CVE-2026-67325_p2.patch \
             file://CVE-2026-67324.patch \
             file://CVE-2026-67322.patch \
+            file://CVE-2026-69097.patch \
            "
 SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"