new file mode 100644
@@ -0,0 +1,60 @@
+From 1ed1b924f4e2d2ee7bab296df77b978af21853f1 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Mon, 20 Jul 2026 14:13:22 +0200
+Subject: [PATCH] fix: validate config section delimiters
+
+GHSA-3rp5-jjmw-4wv2 identified that configuration section names could alter the
+structure of serialized config despite the existing control-character checks.
+
+Reject unquoted closing section delimiters across all writer entry points
+while preserving valid delimiters inside quoted subsections and the
+existing option-name behavior. Add regression coverage for unsafe plain and
+quoted-subsection-shaped names as well as a valid quoted subsection.
+
+Git baseline: a23bace963d508bd96983cc637131392d3face18. Git config parsing
+treats an unquoted closing bracket as the end of a basic section header, while
+its extended form permits brackets inside a quoted subsection and requires a
+final bracket after the closing quote.
+
+CVE: CVE-2026-69097
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1]
+
+Backport Changes:
+- Omitted test/test_config.py because the current PyPI
+ source archive does not include the test suite and
+ the python3-git recipe does not run it.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f1)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/git/config.py b/git/config.py
+index 236de3a6..21f6e8aa 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -875,6 +875,22 @@ GitConfigParser._assure_config_name_safe
+ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
+ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
+ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++ if label == "section" and isinstance(name, str):
++ in_quotes = False
++ escaped = False
++ for index, char in enumerate(name):
++ if escaped:
++ escaped = False
++ elif in_quotes and char == "\\":
++ escaped = True
++ elif char == '"':
++ if not in_quotes and (index == 0 or name[index - 1] not in " \t"):
++ raise ValueError("Git config quoted subsection names must begin after whitespace")
++ in_quotes = not in_quotes
++ elif char == "]" and not in_quotes:
++ raise ValueError("Git config section names must not contain an unquoted closing bracket")
++ if in_quotes:
++ raise ValueError("Git config section names must not contain an unterminated quote")
+
+
+ @needs_values
@@ -27,6 +27,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-67325_p2.patch \
file://CVE-2026-67324.patch \
file://CVE-2026-67322.patch \
+ file://CVE-2026-69097.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1 [2] https://security-tracker.debian.org/tracker/CVE-2026-69097 Signed-off-by: Yogita Urade <yurade@cisco.com> --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Restored the longer upstream commit explanation and Sebastian Thiel co-author trailer, and corrected the abbreviated upstream/cherry-pick hash to the full commit hash. The source fix is unchanged. --- .../python/python3-git/CVE-2026-69097.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch