From patchwork Fri Oct 16 05:40:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100997 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 220AFCCF2CB for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15274.1792129268537946542 for ; Thu, 15 Oct 2026 22:41:08 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=LxpkRP3F; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6129; q=dns/txt; s=iport01; t=1792129268; x=1793338868; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=BiRZo0sEvs4aN0Z9i30YT/i5JUqYhDeGtmuQubDdluc=; b=LxpkRP3FXsAFicxV5oj7CXilVbJXdV2IsWU73cNCkYPQuxlRCNUBngTv /3Flvu0L3aNuAa7HdHxT7BxxBXi7C2gYtuSAFw0VdLeP/WLaUkQhPlPTB 1Vg38ZB7XoFptQpO4XM2JKwdlpi9zqfGfUXMZn6VfSfnGJ+wVZ2xMJlgI NnHcygywu2UyGuOZYbS8DWQudJDQvQakU6FEmJ86ZBKb8v2izz4OB9Bty XODDyrNd0KHBom6Ucz/zBE7nDE8yuIg2OMSsme7dKd2W5kFreVwce9zyA QGqAzmkHmuIpiSxk/8f2rwvb/U36wyNffUzo7YckhcjMPV3ggiGgx/hug g==; X-CSE-ConnectionGUID: 6aEyQRKBQLegt1WFmVeV9g== X-CSE-MsgGUID: eh6OCSX/RlSbEy0WWSzGCw== X-IPAS-Result: A0BJAgAeuNFq/5X/Ja1aH4I6gld1YENJlCmCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8eIF5M4EBgmZDAT8CAkABUNhLEG+BaAELFAGBOIVAiCNdGAFEhDgnG4FJRIR+gQWBXAEBAoElhn4EgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImTT0kLQErFy+CNJJpATiPZIIhgTWfWoQojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBRwsHMxoIGxWDIglKGQ+OKw4Lg2CBf4NlyHYnMgIJMgEBBwIHDgMLgWiEYYsfAiYHgU8BAQ IronPort-Data: A9a23:u9sasaldQ9z8p0i/ehrTjjzo5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJOXDjQPPqCMWfxcoh3O4SypkwGv5XTzdUyHQY+rS9mF1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FdMR1/dOO0Jkz NgVJyxUUT6Gue+Ikb3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMmZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTaz/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYGLJoPSHpUK9qqej m/GoUPSOSFdDtikwxeUqk2Tvf3gtjyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzJCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:C1H5NqxG8WJMKZW7Wt+UKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:aRvQfGoLAlb5TyAFWzawrTvmUZ4sX2zk9lT6Gmu1Bnowd5OQd1Kuqawxxg== X-Talos-MUID: 9a23:41/XHAlKQd0JE3Xe5wrWdnpvNJlPyJ+eT3oJqp8rqpG7ChdiFByC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536470387" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:07 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 82B0A180001CB for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 25A06CBF201; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 01/27] python3-git: fix CVE-2026-67326 Date: Thu, 15 Oct 2026 22:40:40 -0700 Message-Id: <20261016054106.210444-2-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247932 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-67326 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67326.patch | 108 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 109 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch new file mode 100644 index 0000000000..2689d1cc74 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch @@ -0,0 +1,108 @@ +From 89d7d33485f67d5f25777079797ae6d1a4538f86 Mon Sep 17 00:00:00 2001 +From: "GPT 5.5" +Date: Tue, 5 May 2026 21:34:42 +0800 +Subject: [PATCH] Validate config key section names before writing + +GitConfigParser already rejected CR, LF, and NUL in config values before +writing, but section and option names could still reach configparser. Because +GitPython writes section headers itself, a newline-bearing section name could +split the output into additional headers. + +Reject CR, LF, and NUL in section and option names on write paths that create +or set config keys: add_section(), set(), set_value(), add_value(), and +rename_section() destinations. This matches Git config key validation behavior; +Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys +containing newlines from config.c, and local git 2.50.1 rejects newline-bearing +config keys. + +Add a regression test covering unsafe section and option names while preserving +safe writes. + +CVE: CVE-2026-67326 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 54538428f79b0c91ba52cda5229856a6edf7ac06) +Signed-off-by: Yogita Urade +--- + git/config.py | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index 1595d51f..236de3a6 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -72,6 +72,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr + See: https://git-scm.com/docs/git-config#_conditional_includes + """ + ++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ++"""Characters that cannot be safely written in config names or values.""" ++ + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 + """Utility class wrapping base-class methods into decorators that assure read-only +@@ -759,6 +762,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def add_section(self, section: str) -> None: + """Assures added options will stay in order.""" ++ self._assure_config_name_safe(section, "section") + return super().add_section(section) + + @property +@@ -865,10 +869,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: + value_str = self._value_to_string(value) +- if re.search(r"[\r\n\x00]", value_str): ++ if UNSAFE_CONFIG_CHARS_RE.search(value_str): + raise ValueError("Git config values must not contain CR, LF, or NUL") + return value_str + ++ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: ++ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): ++ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ + @needs_values + @set_dirty_and_flush_changes + def set( +@@ -877,6 +885,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + option: str, + value: Union[str, bytes, int, float, bool, None] = None, + ) -> None: ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + if value is not None: + value = self._value_to_string_safe(value) + return super().set(section, option, value) +@@ -901,6 +911,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + :return: + This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -929,6 +941,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + :return: + This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -949,6 +963,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + """ + if not self.has_section(section): + raise ValueError("Source section '%s' doesn't exist" % section) ++ self._assure_config_name_safe(new_name, "section") + if self.has_section(new_name): + raise ValueError("Destination section '%s' already exists" % new_name) + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index ebb5e4b442..474206d4ed 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -21,6 +21,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44243_p2.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ + file://CVE-2026-67326.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100984 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18D1ECCA464 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15275.1792129268839428503 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=FLy1OfZd; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=15852; q=dns/txt; s=iport01; t=1792129268; x=1793338868; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=DsgcTeruhLPtE3g9n6S1yCUoIM7wc6eLBNKzf+HLAQ0=; b=FLy1OfZdZvfx8IwaISVSz5587yc/O9nEKPCDGh9W284iZrMz2i9m63VG IrIMeJY2dnFsLJYB2hhnZVLYALe5q4/4oNyjBWvbkQ6cyExsagQ+eRv77 sKXJHUFGVB4YxhdEH4sO1ZaV8+QtHovfVVaqWN60C+bLVdaBA1ZJ4V1l5 7H8DE6drdXHAnKlFI0dOMMbWeyEzFl+u2tpx1AYH6Y7i2XZ9lGox7hVn7 3RhODob/Cb7V6dJlAL6Wf3heLtVmrr7o+Zlnp4TTUKRD/Mv7TAT+Hz+yC VuShfa8vNJci4scXg/pppN7lUzVc1VTw39mDdOBKRKJPKAlLLw/21Wiu3 A==; X-CSE-ConnectionGUID: eMjgKJK/SlGB6N0VHMZC4Q== X-CSE-MsgGUID: nUFJQ9YSSjCCMmegTnr5fg== X-IPAS-Result: A0BLAgCGuNFq/5H/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8eIF5M4EBgykBPwICQAFQ2EsQb4FoAQsUAYE4hUCII10YAUSCVYFjJxuBSUSBFYNpgQWBMioBAQKCCoYZBIMcEoFagQOOSoV6SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGAgzEj0kLQErIlkKPgobEBw0BiySZ5JAoQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBRwsHMxoIGxU7gmcJShkPjisOC4NggX+DZch2JzICBgMyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:U/kWlKgCw+6FVt9lILNBXvtcX161NxEKZh0ujC45NGQN5FlHY01je htvUDvTOv2MamTxKYx2aIm+8EJQusLVxodqTwFuqiFjFX9jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUV3+R4IkNts sccBxpTSEi9p8eE6+6CH7wEasQLdKEHPasFsX1miDWcBvE8TNWbE+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgp/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJIPSFJsIxC50o ErAwkrbO0ArD+ed4hGg93+juunVwC30Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBUCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:8ORKJKk02CPUN1ejw1q9LuAm0YDpDfIA3DAbv31ZSRFFG/Fw8P re+MjzuiWbtN98YhwdcJW7Scq9qBDnhPtICPcqXItKNTOO0ADDEGgh1/qB/9SKIULDH4BmuZ uIC5IfNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:FzEgg27W54nwdgH9r9ss+WsWFeMHUTrmyFj6fWngN0ZMepbJcArF X-Talos-MUID: 9a23:7gfkpAiIWu/6jT0tzGEF78MpMvpGwZ3/OXs2k74tnsyJOhB2IWqTg2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709652" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:07 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 85FAE180001C5 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 28264CBF202; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 02/27] python3-git: fix CVE-2026-67323 Date: Thu, 15 Oct 2026 22:40:41 -0700 Message-Id: <20261016054106.210444-3-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247935 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-67323 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67323.patch | 356 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 357 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch new file mode 100644 index 0000000000..fa6270d305 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch @@ -0,0 +1,356 @@ +From 80bf84d6f24adcc181b78d71fa94544924a85b2c Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 15:06:42 +0200 +Subject: [PATCH] fix: Guard unsafe git command options (GHSA-956x-8gvw-wg5v) + +Reject command options that can execute arbitrary helpers or write files when passed through archive, revision traversal, blame, clone, fetch, pull, push, and ls-remote APIs. Validate positional option tokens and transformed keyword options consistently, including Git-supported long-option abbreviations, attached short-option values, and falsey stringifiable remotes. Preserve explicit allow_unsafe_options and allow_unsafe_protocols escape hatches. + +Add regression coverage for each guarded API, option spelling and abbreviation forms, inert keyword values, mixed positional and keyword candidates, tuple blame options, stringifiable remotes, and unsafe commands that must not create marker files. + +CVE: CVE-2026-67323 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738] + +Backport Changes: +- Omitted test/test_clone.py, test/test_commit.py, test/test_git.py, + test/test_remote.py, test/test_repo.py because the current PyPI + source archive does not include the test suite and the python3-git + recipe does not run it. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 701ce32fe5ba8cb622c0e0342a376a6beb47d738) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 37 ++++++++++++++++++++- + git/objects/commit.py | 12 +++++++ + git/remote.py | 15 ++++++-- + git/repo/base.py | 80 +++++++++++++++++++++++++++++++++++++++---- + 4 files changed, 133 insertions(+), 11 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index bb8f93a849547e61e4f8fb9055e4be047b2dae38..016d476e38e84439dd325113b4a38133b6d768a0 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -416,6 +416,11 @@ class Git(metaclass=_GitMeta): + + re_unsafe_protocol = re.compile(r"(.+)::.+") + ++ unsafe_git_ls_remote_options = [ ++ # This option allows arbitrary command execution in git-ls-remote. ++ "--upload-pack", ++ ] ++ + def __getstate__(self) -> Dict[str, Any]: + return slots_to_dict(self, exclude=self._excluded_) + +@@ -742,6 +748,20 @@ class Git(metaclass=_GitMeta): + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) + ++ @classmethod ++ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]: ++ """Collect possible option spellings before command-line transformation.""" ++ options = [ ++ option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-") ++ ] ++ if kwargs: ++ for key, value in kwargs.items(): ++ values = value if isinstance(value, (list, tuple)) else (value,) ++ if any(value is True or (value is not False and value is not None) for value in values): ++ key = str(key) ++ options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") ++ return options ++ + class AutoInterrupt: + """Process wrapper that terminates the wrapped process on finalization. + +@@ -1011,6 +1031,22 @@ class Git(metaclass=_GitMeta): + + self._persistent_git_options = self.transform_kwargs(split_single_char_options=True, **kwargs) + ++ def ls_remote( ++ self, ++ *args: Any, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]: ++ """List references in a remote repository. ++ ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--upload-pack`` or ``--exec``. ++ """ ++ if not allow_unsafe_options: ++ candidate_options = self._option_candidates(args, kwargs) ++ Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options) ++ return self._call_process("ls_remote", *args, **kwargs) ++ + @property + def working_dir(self) -> Union[None, PathLike]: + """:return: Git directory we are working on""" +@@ -1488,7 +1524,7 @@ class Git(metaclass=_GitMeta): + return args + + @classmethod +- def _unpack_args(cls, arg_list: Sequence[str]) -> List[str]: ++ def _unpack_args(cls, arg_list: Sequence[Any]) -> List[str]: + outlist = [] + if isinstance(arg_list, (list, tuple)): + for arg in arg_list: +diff --git a/git/objects/commit.py b/git/objects/commit.py +index d957c90514989c34f4bfd343b0061e6e8c3b8d2c..cc85e7dd9b2ae10a0587148452af463980775a73 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -86,6 +86,12 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + # INVARIANTS + default_encoding = "UTF-8" + ++ # Options to :manpage:`git-rev-list(1)` that can overwrite files. ++ unsafe_git_rev_options = [ ++ "--output", ++ "-o", ++ ] ++ + type: Literal["commit"] = "commit" + + __slots__ = ( +@@ -302,6 +308,7 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + repo: "Repo", + rev: Union[str, "Commit", "SymbolicReference"], + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator["Commit"]: + R"""Find all commits matching the given criteria. +@@ -330,6 +337,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + raise ValueError("--pretty cannot be used as parsing expects single sha's only") + # END handle pretty + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=cls.unsafe_git_rev_options ++ ) ++ + # Use -- in all cases, to prevent possibility of ambiguous arguments. + # See https://github.com/gitpython-developers/GitPython/issues/264. + +diff --git a/git/remote.py b/git/remote.py +index f2ecd0f360e763aa5415a40543095d43727fc31e..cafa1f84267f2703de9fdf73983ca0646b82f010 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -1061,7 +1061,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_fetch_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_fetch_options, ++ ) + + proc = self.repo.git.fetch( + "--", self, *args, as_process=True, with_stdout=False, universal_newlines=False, v=verbose, **kwargs +@@ -1115,7 +1118,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_pull_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_pull_options, ++ ) + + proc = self.repo.git.pull( + "--", self, refspec, with_stdout=False, as_process=True, universal_newlines=False, v=True, **kwargs +@@ -1188,7 +1194,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_push_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_push_options, ++ ) + + proc = self.repo.git.push( + "--", +diff --git a/git/repo/base.py b/git/repo/base.py +index 8059fcebeb83be30c4aeefdefa4c6fdb96bcd81e..3380e0c5fbec391c84a14c9292eb98a8bcc484c9 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -160,6 +160,20 @@ class Repo: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt + """ + ++ unsafe_git_archive_options = [ ++ # Allows arbitrary command execution through the remote git-upload-archive command. ++ "--exec", ++ # Writes output to a caller-controlled filesystem path. ++ "--output", ++ "-o", ++ ] ++ ++ unsafe_git_revision_options = [ ++ # This option allows output to be written to arbitrary files before revision parsing. ++ "--output", ++ "-o", ++ ] ++ + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") + """Represents the configuration level of a configuration file.""" +@@ -743,6 +757,7 @@ class Repo: + self, + rev: Union[str, Commit, "SymbolicReference", None] = None, + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator[Commit]: + """An iterator of :class:`~git.objects.commit.Commit` objects representing the +@@ -760,6 +775,9 @@ class Repo: + Arguments to be passed to :manpage:`git-rev-list(1)`. + Common ones are ``max_count`` and ``skip``. + ++ :param allow_unsafe_options: ++ Allow unsafe options in the revision argument, like ``--output``. ++ + :note: + To receive only commits between two named revisions, use the + ``"revA...revB"`` revision specifier. +@@ -770,7 +788,18 @@ class Repo: + if rev is None: + rev = self.head.commit + +- return Commit.iter_items(self, rev, paths, **kwargs) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) ++ ++ return Commit.iter_items( ++ self, ++ rev, ++ paths, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + + def merge_base(self, *rev: TBD, **kwargs: Any) -> List[Commit]: + R"""Find the closest common ancestor for the given revision +@@ -1035,7 +1064,9 @@ class Repo: + # reveal_type(self.head.reference) # => Reference + return self.head.reference + +- def blame_incremental(self, rev: str | HEAD | None, file: str, **kwargs: Any) -> Iterator["BlameEntry"]: ++ def blame_incremental( ++ self, rev: str | HEAD | None, file: str, allow_unsafe_options: bool = False, **kwargs: Any ++ ) -> Iterator["BlameEntry"]: + """Iterator for blame information for the given file at the given revision. + + Unlike :meth:`blame`, this does not return the actual file's contents, only a +@@ -1046,6 +1077,9 @@ class Repo: + uncommitted changes. Otherwise, anything successfully parsed by + :manpage:`git-rev-parse(1)` is a valid option. + ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ + :return: + Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the + commit to blame for the line, and range indicates a span of line numbers in +@@ -1054,6 +1088,10 @@ class Repo: + If you combine all line number ranges outputted by this command, you should get + a continuous range spanning all line numbers in the file. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) + + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) + commits: Dict[bytes, Commit] = {} +@@ -1132,7 +1170,8 @@ class Repo: + rev: Union[str, HEAD, None], + file: str, + incremental: bool = False, +- rev_opts: Optional[List[str]] = None, ++ rev_opts: Optional[Sequence[str]] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[List[Commit | List[str | bytes] | None]] | Iterator[BlameEntry] | None: + """The blame information for the given file at the given revision. +@@ -1142,6 +1181,9 @@ class Repo: + uncommitted changes. Otherwise, anything successfully parsed by + :manpage:`git-rev-parse(1)` is a valid option. + ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ + :return: + list: [git.Commit, list: []] + +@@ -1151,9 +1193,14 @@ class Repo: + appearance. + """ + if incremental: +- return self.blame_incremental(rev, file, **kwargs) +- rev_opts = rev_opts or [] +- data: bytes = self.git.blame(rev, *rev_opts, "--", file, p=True, stdout_as_string=False, **kwargs) ++ return self.blame_incremental(rev, file, allow_unsafe_options=allow_unsafe_options, **kwargs) ++ rev_opts_list = list(rev_opts or []) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev, rev_opts_list], kwargs), ++ unsafe_options=self.unsafe_git_revision_options, ++ ) ++ data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} + blames: List[List[Commit | List[str | bytes] | None]] = [] + +@@ -1364,7 +1411,10 @@ class Repo: + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(str(url)) + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=cls.unsafe_git_clone_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_clone_options, ++ ) + if not allow_unsafe_options and multi: + Git.check_unsafe_options(options=multi, unsafe_options=cls.unsafe_git_clone_options) + +@@ -1539,6 +1589,8 @@ class Repo: + ostream: Union[TextIO, BinaryIO], + treeish: Optional[str] = None, + prefix: Optional[str] = None, ++ allow_unsafe_options: bool = False, ++ allow_unsafe_protocols: bool = False, + **kwargs: Any, + ) -> Repo: + """Archive the tree at the given revision. +@@ -1561,6 +1613,12 @@ class Repo: + repository-relative path to a directory or file to place into the archive, + or a list or tuple of multiple paths. + ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--exec`` or ``--output``. ++ ++ :param allow_unsafe_protocols: ++ Allow unsafe protocols to be used in ``remote``, like ``ext``. ++ + :raise git.exc.GitCommandError: + If something went wrong. + +@@ -1571,6 +1629,14 @@ class Repo: + treeish = self.head.commit + if prefix and "prefix" not in kwargs: + kwargs["prefix"] = prefix ++ remote = kwargs.get("remote") ++ if not allow_unsafe_protocols and remote is not None: ++ Git.check_unsafe_protocols(str(remote)) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_archive_options, ++ ) + kwargs["output_stream"] = ostream + path = kwargs.pop("path", []) + path = cast(Union[PathLike, List[PathLike], Tuple[PathLike, ...]], path) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 474206d4ed..72eb073196 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -22,6 +22,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-67326.patch \ + file://CVE-2026-67323.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101005 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9268DCCA464 for ; Fri, 16 Oct 2026 05:41:29 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15278.1792129282730516981 for ; Thu, 15 Oct 2026 22:41:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=S0R0lBfx; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6900; q=dns/txt; s=iport01; t=1792129283; x=1793338883; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=q3nVjgQwAP82VwQ2c11u995ZVQSiOyCWpgRLcwWn4MQ=; b=S0R0lBfxP4vovyiI+wu63RTvphYrWUezrcjtZpkOVR9FE1OTK66UeDQQ HEPLt9r7oHyz8UJMGyOIjHu68ETztKTsm6BSTm/6ReMZEekSs0ggD6NMV HxKDyOUNjmwsseXVIHTEC9y9r6nj6dBAh/P5sT+TRssQlZqDeXlKZBake /ZvSKNjj4nRX7H0RAL22Vc8DmxkMlLGnqWYPzD2xUDtRfiPo3Dtg3Tz39 iT1JWHr58MzWrCEfvDWUP7PLX1QO5oBZa1BzwwcN//3xJvJmwd8Qeveun EITY6Q5hgNhfubAIc4zAfF2awZvlfewgnW6lOP3tKkjUEhzhAMXgoE5vK Q==; X-CSE-ConnectionGUID: Cez3HmX8Sx+HVxnhDJFsMg== X-CSE-MsgGUID: ZCfCYeWFSw6/MIg7163SRw== X-IPAS-Result: A0DkAgCGuNFq/5H/Ja1aHgEBCxIMggULgld1YENJA5QmgiEDi2WSN4F+DwEBAQ9EDQQBAYQ/RgKOFQImNQgOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLyALIwgZgwIBgjoDNwMRvHiBeTOBAYMpAT8CQ1DYSw0Db4FoAQsUAYE4hUCCf4UkXRgBRIQ4JxuBSUSEfoEFgRpCAQGBJ4Z+BIMcEoFagQOUREiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXMlTQEsEFEBCiGBVT6UCY9kgiGBNZ5pcYQojCKPPoV8GjOqbwuYfY4KhAmRMS1ohGmBaQE6gUcLBzMaCBsVO4JnCUoZD445g2uBf4NlyHYnMgIGAzIBAQcCBw4DC4FokAACJgeBTwEB IronPort-Data: A9a23:vriwRas/8kmL1PgHGjaUlEdNpefnVAFfMUV32f8akzHdYApBsoF/q tZmKTqFO/yMMWCgedEgPY+1/UgAv5aGzoI1SQo9rntmQ3sWgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvra9ks21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw0etlWkFLx awjOHMtUACFh86U7qmeRbw57igjBJGD0II3oHpsy3TdSP0hW52GG/WM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtKYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIIIzSGJUJwh3wS mTuzU/3KSAXC/Kk1mTC11Oj2baRxhjBR9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cHnhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:IwvgvK+jFMPqXEAD2b9uk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:PsLpW2CAwb62+2v6EwJq5hU0H/B1SW2e7EnAJU+UK0hybbLAHA== X-Talos-MUID: 9a23:mH0RNg6Hi47hRy0Hfdr6a1ozxoxayKqFOU0yv64Z5Y6hFCMvYmnGtw6oF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528058443" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:07 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 89F8818000443 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 32600CBF203; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 03/27] python3-git: fix CVE-2026-67325 Date: Thu, 15 Oct 2026 22:40:42 -0700 Message-Id: <20261016054106.210444-4-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247956 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f [2] https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-67325 Signed-off-by: Yogita Urade --- .../python3-git/CVE-2026-67325_p1.patch | 49 ++++++++++++++++++ .../python3-git/CVE-2026-67325_p2.patch | 50 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 2 + 3 files changed, 101 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch new file mode 100644 index 0000000000..94137ec994 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch @@ -0,0 +1,49 @@ +From 048f65847761514ebccf3cd8a889fef7a0068c07 Mon Sep 17 00:00:00 2001 +From: abhiprd2000 <8292aniarc@gmail.com> +Date: Thu, 9 Jul 2026 21:22:50 +0530 +Subject: [PATCH] Reject abbreviated forms of unsafe git options + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +(cherry picked from commit 2ab051697940144545a14d2f4a639c6409c3187f) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 016d476e38e84439dd325113b4a38133b6d768a0..d6afe26206dd86597cb7bddd653b1de6eca385d9 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -740,13 +740,20 @@ class Git(metaclass=_GitMeta): + arbitrary commands. These are blocked by default. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. ++ # Git accepts any unambiguous prefix of a long option, so an abbreviated ++ # spelling such as `--upl` for `--upload-pack` must be rejected too. An ++ # option is unsafe if its canonical name is a prefix of any blocked ++ # option's canonical name. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} + for option in options: +- unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option)) +- if unsafe_option is not None: +- raise UnsafeOptionError( +- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." +- ) ++ candidate = cls._canonicalize_option_name(option) ++ if not candidate: ++ continue ++ for canonical, unsafe_option in canonical_unsafe_options.items(): ++ if canonical.startswith(candidate): ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) + + @classmethod + def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]: diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch new file mode 100644 index 0000000000..5060a16ae3 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch @@ -0,0 +1,50 @@ +From 6de6760007664e5e9178b98e616d0b9edc959a53 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 13:45:42 +0200 +Subject: [PATCH] Address review feedback about unsafe option abbreviations + +The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs. + +This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected. + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63] + +Backport Changes: +- Omitted test/test_clone.py, test/test_git.py because the current + PyPI source archive does not include the test suite and the + python3-git recipe does not run it. + +Reviewd-by: Sebastian Thiel +(cherry picked from commit 181e8ede7543dbbdcee92756cea260f675316c63) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index f3f08503..d90092c6 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -737,12 +737,20 @@ class Git(metaclass=_GitMeta): + # Git accepts any unambiguous prefix of a long option, so an abbreviated + # spelling such as `--upl` for `--upload-pack` must be rejected too. An + # option is unsafe if its canonical name is a prefix of any blocked +- # option's canonical name. ++ # option's canonical name. Only long options and multi-character kwargs ++ # can be abbreviations; single-character short options remain exact-match ++ # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) + if not candidate: + continue ++ unsafe_option = canonical_unsafe_options.get(candidate) ++ if unsafe_option is not None: ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): ++ continue + for canonical, unsafe_option in canonical_unsafe_options.items(): + if canonical.startswith(candidate): + raise UnsafeOptionError( diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 72eb073196..76a21c670f 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -23,6 +23,8 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-67326.patch \ file://CVE-2026-67323.patch \ + file://CVE-2026-67325_p1.patch \ + file://CVE-2026-67325_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100999 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71FDDCCF2CE for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15556.1792129268499960934 for ; Thu, 15 Oct 2026 22:41:08 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=JjpWh0nP; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6488; q=dns/txt; s=iport01; t=1792129268; x=1793338868; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=6w9LIhIKN6ajhKp2RJMxV8G6boiIIaoxRIYARXifgGY=; b=JjpWh0nPsmXmOkhvYONh74WcxYRtxzpaVAHCavgoc13a2dFLhH1Liisi PZFndL1QEXc+r4IQ5yxt4JSdMxPz1GasQ4+3AiLIEQUIdTVwUi/eLXriv 75voiZyYzLp/3apfyEP/I6S1DmSirWeXOKv3Iy7ne3OfErbGKmXTQNJe7 Mayygn7lnhDAX9zgB89GDNM+mqjbZd7/Prs1ww+bBiZGY4i79R7y1RpWC f9/74wZQZTNKDj2aAsDafaSWIET4B2Eyg1pPec+2eNPDBNrqX8mrgqFFV JkJLdAmoYQjxBVLLHD5Tobplf0fEgoNxPDqU0d5GQQe75/oIBSII/evW9 g==; X-CSE-ConnectionGUID: ynchupdAR+yoTvKatomY9g== X-CSE-MsgGUID: U/3AWODLQxa7rnMk9ejwpw== X-IPAS-Result: A0BLAgCRt9Fq/4z/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8d4F5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEhDgnG4FJRIEVg2mBBYFcAQGIJQSDHBKBWoEDjkqFekiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghgIMxIBLBBRAQohghSmDZ9RgT6EKIwilToaM6pvC5h9jgqVOoEVhGmBaDyBRwsHMxoIGxU7gmcJShkPjjmDa4F/g2XIdicyAgYDMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:CwIcaqyTXiYNgY+ros56t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkVSz jQeDTyCP6qIMDOmc9tzPY+x8UgF6pODmtI3TgFlqVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFAwNo0F4upeOyJf8 sAGCzkRaRWy1u3jldpXSsE07igiBNPgMIVavjRryivUSK59B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cO3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzaoCKJYLTLSlTtnvf/ Uv52EjdOwETa8aZ7DnU/3CznvCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu13fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:mlEA5K6FKHrXyahjIgPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:hyVC8WvrdrSebBjGLF/fbXx96Is0dHbd0W/cCnX7GGFVVp6cVViVyfJrxp8= X-Talos-MUID: 9a23:r7rDMQgukIwkpRxXqWGYQsMpCYAzypuJJGQ0gZxZoc+hNn19OSiFk2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536227761" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:07 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 8E3D8180001EB for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 37A9ECBF204; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 04/27] python3-git: fix CVE-2026-67324 Date: Thu, 15 Oct 2026 22:40:43 -0700 Message-Id: <20261016054106.210444-5-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247933 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-67324 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67324.patch | 101 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 102 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch new file mode 100644 index 0000000000..6f32bcce4f --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch @@ -0,0 +1,101 @@ +From b09720b6f8311edac108392bd834e74918836c4f Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 14:12:16 +0200 +Subject: [PATCH] fix: reject joined unsafe short options + +GitPython blocks options such as --upload-pack/-u and --config/-c +because they can execute arbitrary commands unless unsafe options are +explicitly allowed. Git also accepts a short option with its value +joined to the same token, including after clusterable flags. Forms +such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore +bypass an exact-token check. + +Parse single-dash option tokens sufficiently to recognize blocked +short options while preserving safe attached values such as +-oupstream. Also distinguish clone multi-option values from bare +kwargs so positional values are not treated as long-option +abbreviations. + +This completes the option-validation hardening for +GHSA-2f96-g7mh-g2hx. + +CVE: CVE-2026-67324 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285] + +Backport Changes: +- Omitted test/test_clone.py, test/test_git.py, test/test_remote.py + because the current PyPI source archive does not include the test + suite and the python3-git recipe does not run it. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 56806080c1348749b07daa4a2024ce47b3cad285) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 40 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 523029fc..75495dc1 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -733,10 +733,23 @@ class Git(metaclass=_GitMeta): + + @classmethod + def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: +- """Check for unsafe options. +- +- Some options that are passed to ``git `` can be used to execute +- arbitrary commands. These are blocked by default. ++ """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. ++ ++ In addition to exact matches, this rejects abbreviated long options accepted ++ by Git (for example, ``--upl`` for ``--upload-pack``) and unsafe short options ++ whose values are joined to the same token, including after clusterable flags ++ (for example, ``-uVALUE`` and ``-fuVALUE``). ++ ++ A list containing only bare names is treated as normalized keyword arguments, ++ so multi-character names such as ``upload_p`` are checked as long-option ++ abbreviations. If any item starts with ``-``, the list is treated as tokenized ++ command-line input: bare items can be option values and are not checked as ++ abbreviations. Thus ``["--origin", "upload"]`` is allowed. Single-dash options ++ use short-option parsing rather than broad prefix matching, preserving safe ++ attached values such as ``-oupstream`` and ``-bcurrent``. ++ ++ Some options passed to ``git `` can execute arbitrary commands and ++ are therefore blocked by default unless the caller explicitly allows them. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. + # Git accepts any unambiguous prefix of a long option, so an abbreviated +@@ -746,6 +759,15 @@ class Git(metaclass=_GitMeta): + # can be abbreviations; single-character short options remain exact-match + # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ unsafe_short_options = { ++ canonical: option ++ for canonical, option in canonical_unsafe_options.items() ++ if option.startswith("-") and not option.startswith("--") and len(canonical) == 1 ++ } ++ # These value-less Git flags can be clustered before another short option ++ # (for example, ``-fuVALUE``). Stop at any other character because it may ++ # begin an attached value, as ``o`` does in the safe option ``-oupstream``. ++ clusterable_short_options = frozenset("46flnqsv") + options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) +@@ -754,6 +776,16 @@ class Git(metaclass=_GitMeta): + unsafe_option = canonical_unsafe_options.get(candidate) + if unsafe_option is not None: + raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ option_token = option.split("=", 1)[0].split(None, 1)[0] ++ if option_token.startswith("-") and not option_token.startswith("--"): ++ for option_char in option_token[1:]: ++ unsafe_option = unsafe_short_options.get(option_char) ++ if unsafe_option is not None: ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) ++ if option_char not in clusterable_short_options: ++ break + if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): + continue + for canonical, unsafe_option in canonical_unsafe_options.items(): diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 76a21c670f..ca2efce37e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -25,6 +25,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67323.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ + file://CVE-2026-67324.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100990 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B481FCCA491 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15557.1792129268905469582 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Qalx00nE; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7829; q=dns/txt; s=iport01; t=1792129268; x=1793338868; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=fd8SxDslBfeFvoJNuvu9U4kosQ4CnQlblDozKVUsGh8=; b=Qalx00nEtTz+Xq5mtNfttzh7AtatIY2FSLBJTNdeHZzlU4apV30ljT+9 Kl7iu3MmV+YgYpXZf57wla0djrfCDpsI0VK7JDv/XHqF1AfE666BdqIbz UHyAG+MNRxZUD659jrvtjwN8e+fQcFvykPiZtAzoSjRoQMXs7hcCLpBrj IZ/wAF39qumerLkzL623q85gFuVcQscar59RVHRVkdzyTKxjOXhRf/PUp q4R6PkIYTIZZLleo/MOM21eRJxal47I8j4d0dIZdg4bShxZ2tbI2dvn+Z SMRFEVXiIjBotEULVvu6J4HTnJqchYGzNcl8aCmEe2M5H0gtAEvsZTbNp Q==; X-CSE-ConnectionGUID: 46yjlOgwQX2DmIrrBunUOA== X-CSE-MsgGUID: JyFtbXweR5iAaVsNsntWWQ== X-IPAS-Result: A0BLAgAeuNFq/5D/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysdAQUIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAUSEOCcbgUlEgRWDaYEFgVwBAYglBIMcEoFagQOUREiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghg7Ej0cGwcEDwErgTQPCgQsL5M1kkChD4QojCKVOhozhVulFAuYfY4Klk+EaYFoPIFHCwczGggbFTuCZwlKGQ+OOYNrgX+DZWzICicyAgYDMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:lcknMq+ncki9OUA8SWBFDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3z DEdDW3SafmKMzT2Ld5/bIy18UgO7cPdxt5gQAY5qXxEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2lqY5wa/sF4Hlh+r 9AdCSoXRA2FusWflefTpulE3qzPLeHxN48Z/3UlxjbDALN+HtbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0En1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2bYeEKoDbFa25mG66t 0za9VTmDytHNfWW9yGj6XSwudD2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:FuL7IK5z3EVvJNH99gPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:CZYmrmEhRrapMskYqmI7ql8WHucqbUTtllvVAlWiI3tvdZq8HAo= X-Talos-MUID: 9a23:nU1CPA/sjMUda1poQApt/W6Qf+V5zbikOF8Aq8gHksC6LgprPSuisw3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535598498" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id E014218000231 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 3F07BCBF21E; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 05/27] python3-git: fix CVE-2026-67322 Date: Thu, 15 Oct 2026 22:40:44 -0700 Message-Id: <20261016054106.210444-6-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247936 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-67322 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67322.patch | 167 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 168 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch new file mode 100644 index 0000000000..6041ff3d2e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch @@ -0,0 +1,167 @@ +From 3ae11b59c9c4cf15f04397d58b8a90b621b6571b Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 15 Jul 2026 16:44:13 +0200 +Subject: [PATCH] fix: prevent environment expansion in clone URLs + +Repo.clone_from() expanded environment-variable references in caller-supplied +URLs before passing them to git clone. This could expose process environment +values to an untrusted remote and made protocol validation apply to a different +value than Git received. + +Polish clone URLs without variable or home expansion on native and Cygwin +Git, then apply unsafe-protocol validation to that exact normalized value. +Preserve the literal URL when normalizing the stored origin after a successful +clone, while retaining the existing Git.polish_url() default for callers +that intentionally normalize local paths. Add regression coverage for +POSIX and Windows variable syntax, Cygwin conversion, stored origins, and +post-normalization protocol validation. + +Git baseline: git clone passes URL arguments through literally; t/t5601-clone.sh +covers the accepted URL forms without shell-style environment expansion. + +Security: GHSA-rwj8-pgh3-r573. + +CVE: CVE-2026-67322 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 8ac5a30519b6f4af85398b9b9d7064ff4d452da2) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 19 ++++++++++++------- + git/repo/base.py | 7 ++++--- + git/util.py | 15 +++++++++------ + 3 files changed, 25 insertions(+), 16 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 75495dc1..58d219e3 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -670,29 +670,34 @@ class Git(metaclass=_GitMeta): + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Literal[False] = ...) -> str: ... ++ def polish_url(cls, url: str, is_cygwin: Literal[False] = ..., expand_vars: bool = ...) -> str: ... + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> str: ... ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> str: ... + + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> PathLike: ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> PathLike: + """Remove any backslashes from URLs to be written in config files. + + Windows might create config files containing paths with backslashes, but git + stops liking them as it will escape the backslashes. Hence we undo the escaping + just to be sure. ++ ++ :param expand_vars: ++ Expand environment variables and an initial ``~``. Disable this for values ++ obtained from an untrusted source, such as remote URLs. + """ + if is_cygwin is None: + is_cygwin = cls.is_cygwin() + + if is_cygwin: +- url = cygpath(url) ++ url = cygpath(url, expand_vars=expand_vars) + else: +- url = os.path.expandvars(url) +- if url.startswith("~"): +- url = os.path.expanduser(url) ++ if expand_vars: ++ url = os.path.expandvars(url) ++ if url.startswith("~"): ++ url = os.path.expanduser(url) + url = url.replace("\\\\", "\\").replace("\\", "/") + return url + +diff --git a/git/repo/base.py b/git/repo/base.py +index 3380e0c5..d661f036 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -1408,8 +1408,9 @@ class Repo: + if multi_options: + multi = shlex.split(" ".join(multi_options)) + ++ clone_url = Git.polish_url(url, expand_vars=False) + if not allow_unsafe_protocols: +- Git.check_unsafe_protocols(str(url)) ++ Git.check_unsafe_protocols(clone_url) + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([], kwargs), +@@ -1421,7 +1422,7 @@ class Repo: + proc = git.clone( + multi, + "--", +- Git.polish_url(str(url)), ++ clone_url, + clone_path, + with_extended_output=True, + as_process=True, +@@ -1461,7 +1462,7 @@ class Repo: + # escape the backslashes. Hence we undo the escaping just to be sure. + if repo.remotes: + with repo.remotes[0].config_writer as writer: +- writer.set_value("url", Git.polish_url(repo.remotes[0].url)) ++ writer.set_value("url", Git.polish_url(repo.remotes[0].url, expand_vars=False)) + # END handle remote repo + return repo + +diff --git a/git/util.py b/git/util.py +index 27b239ab..9619937c 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -382,13 +382,13 @@ def py_where(program: str, path: Optional[PathLike] = None) -> List[str]: + return progs + + +-def _cygexpath(drive: Optional[str], path: str) -> str: ++def _cygexpath(drive: Optional[str], path: str, expand_vars: bool = True) -> str: + if osp.isabs(path) and not drive: + # Invoked from `cygpath()` directly with `D:Apps\123`? + # It's an error, leave it alone just slashes) + p = path # convert to str if AnyPath given + else: +- p = path and osp.normpath(osp.expandvars(osp.expanduser(path))) ++ p = path and osp.normpath(osp.expandvars(osp.expanduser(path)) if expand_vars else path) + if osp.isabs(p): + if drive: + # Confusing, maybe a remote system should expand vars. +@@ -416,7 +416,7 @@ _cygpath_parsers: Tuple[Tuple[Pattern[str], Callable, bool], ...] = ( + ) + + +-def cygpath(path: str) -> str: ++def cygpath(path: str, expand_vars: bool = True) -> str: + """Use :meth:`git.cmd.Git.polish_url` instead, that works on any environment.""" + path = str(path) # Ensure is str and not AnyPath. + # Fix to use Paths when 3.5 dropped. Or to be just str if only for URLs? +@@ -424,12 +424,15 @@ def cygpath(path: str) -> str: + for regex, parser, recurse in _cygpath_parsers: + match = regex.match(path) + if match: +- path = parser(*match.groups()) ++ if parser is _cygexpath: ++ path = parser(*match.groups(), expand_vars=expand_vars) ++ else: ++ path = parser(*match.groups()) + if recurse: +- path = cygpath(path) ++ path = cygpath(path, expand_vars=expand_vars) + break + else: +- path = _cygexpath(None, path) ++ path = _cygexpath(None, path, expand_vars=expand_vars) + + return path + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index ca2efce37e..fafb9972ef 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -26,6 +26,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ + file://CVE-2026-67322.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101003 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BD18CC6B38 for ; Fri, 16 Oct 2026 05:41:29 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15278.1792129282730516981 for ; Thu, 15 Oct 2026 22:41:22 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=gD3w4LYH; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3406; q=dns/txt; s=iport01; t=1792129282; x=1793338882; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=PnpSoqx2T7OGOtN5kCsStnel32d/7bM9qA+uLRo7CRQ=; b=gD3w4LYH5yYnflwLP2ex4llU2RrCHkGVv7PRDTx/a0LTMv5azXBnoeJL UbJ6bhluOdmBSIEeOoNeN4jDUUYu64/Fi/6BiheSca68bZp1ckTe+67tK rHxVjmMMnouwEYk1p0ZWCjWbQ0ZljaSPbm7n3k7ZdfthfuVM4l5D/qjy0 VnyGNQjLxFwys+2MQoD27rvtUfP/9e1BC3r28yXeHj4p2cBHglX5QlkgR kHHiilUsLDSu5Z2tAsK5HpI09pCNEJ+gLD20pIxhQ9HgODsPfZZSv2HM9 mSYVLH9Gi8Znu6MRa+36mdNHYdnVOni+eiOPdBubYjIejguaNI/+i/ekl A==; X-CSE-ConnectionGUID: H4TR2ER4Tu6WfGTJzFKflQ== X-CSE-MsgGUID: F5JxNaocR8edculBhjcPRg== X-IPAS-Result: A0BIAgCGuNFq/5L/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYJ0AxG8eIF5M4EBgmZDAT8CQ1DZSoFoAQsUAYE4hUCII10YAYR8JxuBSUSEfoEFgVwBAYglBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYTT1RAStGgRqUA5AdgiGhD4QojCKVOhozhVulFAuYfY4Klk+EaYFoPIFHCwczGggbFYMiCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:0lVuYq1qebCqHPQjPPbD5YRwkn2cJEfYwER7XKvMYLTBsI5bpzdTy zBKCmnQOa2KNzCmfo9+PYXjoEoO6p/RnNRjGgFr3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGLB0KB9c1wLpLHD9x+ 9MkCiIjTR6HvrfjqF67YrEEasULNsLnOsYb/3pn1zycVadgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUieC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsiui1bYqJJoDiqcN9sBu6t kTP+G/DUhwWP8Gb4zqH+UqWibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MskCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:8o9HdaF63XkhMJWRpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:lwF4NGr7js0y68UddnkzltfmUeB5TkeH4U2MH1LmNmhGdJ+HZ3ye/Joxxg== X-Talos-MUID: 9a23:56IYqAVi7fW9kl7q/BGxpiFEPcBj2fSjBEsQlb8GucK8DyMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528058444" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id E28E918000236 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 43E24CBEF8A; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 06/27] python3-git: fix CVE-2026-69097 Date: Thu, 15 Oct 2026 22:40:45 -0700 Message-Id: <20261016054106.210444-7-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247955 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f [2] https://nvd.nist.gov/vuln/detail/CVE-2026-69097 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-69097.patch | 48 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch new file mode 100644 index 0000000000..fc22c65818 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch @@ -0,0 +1,48 @@ +From 00034e1e5eb542542158461c3c542d3bfd3a49f0 Mon Sep 17 00:00:00 2001 +From: Yogita Urade +Date: Fri, 25 Sep 2026 03:55:16 -0700 +Subject: [PATCH] Validate config section delimiters + +Reject unsafe unquoted closing brackets and malformed quoted subsections. + +CVE: CVE-2026-69097 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI + source archive does not include the test suite and + the python3-git recipe does not run it. + +(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f) +Signed-off-by: Yogita Urade +--- + git/config.py | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/git/config.py b/git/config.py +index 236de3a6..21f6e8aa 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -876,6 +876,22 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "section" and isinstance(name, str): ++ in_quotes = False ++ escaped = False ++ for index, char in enumerate(name): ++ if escaped: ++ escaped = False ++ elif in_quotes and char == "\\": ++ escaped = True ++ elif char == '"': ++ if not in_quotes and (index == 0 or name[index - 1] not in " \t"): ++ raise ValueError("Git config quoted subsection names must begin after whitespace") ++ in_quotes = not in_quotes ++ elif char == "]" and not in_quotes: ++ raise ValueError("Git config section names must not contain an unquoted closing bracket") ++ if in_quotes: ++ raise ValueError("Git config section names must not contain an unterminated quote") + + @needs_values + @set_dirty_and_flush_changes diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index fafb9972ef..781ec512cc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -27,6 +27,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ + file://CVE-2026-69097.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100994 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2E9FCCF2C6 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15274.1792129268537946542 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=WEIM+W72; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3764; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=BLsnZyGBsWCsayrkfyNM0mq7mcmfqPR1fAlPCyh25tM=; b=WEIM+W72mQ5WF1ScROn0Mf7Kt0cr3JC+pKB5/usY0QGne9HvD6wajaE6 eZoO33rkc4z2qdL4xUi0IsuHwUL+YLbHHkrGBWGt3qbRSulyshFawc/HI 9OI2FfL0A+U+LnZ7ldSR38wcT6M9+9MMJrYpecZSDGDTaFm+dBj15o2yY lNwKW01xQLW4DQ+pPnRF9k5ItzfmF2whZbZOMFYYuOWj1bvsLZi+OXzJq fBSC3CccRR1XZ2alf+VgEZHkiiUfFynmc/cq6CVn20JxzxVwoW/TavSQa WjeWmGjTpCoeNTXW9jV4S3U2xnGKeEhXcLeRcbquaCPyyN5qW2WCUentq g==; X-CSE-ConnectionGUID: 3jarvX8PSdm/TjsFXGYEYw== X-CSE-MsgGUID: JJP+0KEtTZG897M3OhKlrQ== X-IPAS-Result: A0BLAgAeuNFq/4r/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8eIF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWDaYEFgVwBAYglBIINgQ8SgVqBA4QLkDlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYTT1RASuCO5MokB2CIaEPhCiMIpU6GjOqbwuYfY4Klk+EaYFoPIFHCwczGggbFTuCZwlKGQ+OOYNrgX+DZch2JzICBgMyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:WKc2mKyxod7CeuzJCPZ6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkUFx 2QXCGiPbvnYZ2LxKo9xa4rk8E5V75CHx95jTgE9+1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJBo0NJcGyrZPOm1Ls sAaMx49QSGutv3jldpXSsE07igiBNPgMIVavjRryivUSK5/B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bM3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzbIWNIYzaLSlTtmS6n iGe3EnlPiM1ZI3A7GGi8lGonNaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1/fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:hBj0Ba9E73lA60MmMJduk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:tENbt2z5jeGviVcLDcQRBgVPGMk/bE2N9EzcJgiEC31HeJKkZG6PrfY= X-Talos-MUID: 9a23:GHQb3AQp2KrPmGSFRXTOpgkhbORF/5icJxBczrBdnMmnMTZJbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536470388" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id EA07B180001D6 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 47E22CBEF98; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 07/27] python3-git: fix CVE-2026-73625 Date: Thu, 15 Oct 2026 22:40:46 -0700 Message-Id: <20261016054106.210444-8-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247940 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73625 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73625.patch | 59 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch new file mode 100644 index 0000000000..6fcdfc88b4 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch @@ -0,0 +1,59 @@ +From ef95f1434023af72deabaf91e7154260d4625271 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:39:00 +0200 +Subject: [PATCH] fix: validate split short-option values + + + +Single-character keyword arguments are transformed into an option token and +a separate value token. The unsafe-option candidate builder only checked the +keyword name, allowing an option-like value to bypass guards shared by clone, +remote, revision, blame, and archive operations. + +Include dash-prefixed values only when short options are actually split, +including sequence values, while preserving bare values and the non-splitting +compatibility path. + +Git baseline a23bace9 defines clone -n and --upload-pack as distinct options, +matching the argv boundary this validation now preserves. + +Refs GHSA-r9mr-m37c-5fr3. + +CVE: CVE-2026-73625 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453] + +Backport Changes: +- Omitted test/test_git.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit e8d0fbf774d1f6baa3b481adfe48bd262e43b453) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/git/cmd.py b/git/cmd.py +index 58d219e3..e2c4bf73 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -806,11 +806,18 @@ class Git(metaclass=_GitMeta): + option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-") + ] + if kwargs: ++ split_single_char_options = kwargs.get("split_single_char_options", True) + for key, value in kwargs.items(): + values = value if isinstance(value, (list, tuple)) else (value,) + if any(value is True or (value is not False and value is not None) for value in values): + key = str(key) + options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") ++ if len(key) == 1 and split_single_char_options: ++ options.extend( ++ str(value) ++ for value in values ++ if value is not True and value not in (False, None) and str(value).startswith("-") ++ ) + return options + + class AutoInterrupt: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 781ec512cc..551b47fc39 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -28,6 +28,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ + file://CVE-2026-73625.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100995 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 003B9CCF2C9 for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15556.1792129268499960934 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KS5r6GkG; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3428; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=OQK68m8DrIcmmF5KziU1fdDIpf22yqE+e3LdZvl3L7c=; b=KS5r6GkGK1wmR8Q3sTVyDHaFxbQ00Lt/qtu39cjpd6mO/JarY5IxPIQk EWZ0dgJkL0XKueC/dP11hq1qGpxvC4O+FFTCRAvzmVJp3Wg+Ud21+qITd Lr9beN8FeXPS+YKqN3Dz7neO+YlnfTUOfST59b3CWWZ/IGXkxqWQS6t4w NrBb2Z5ywFUx3cT8rLWFsrWFOXX1hSu0ZR+AgWRFjvK3Zi2681i+lvPrO PjWH40qBeCaR4Gcrdq23emH9d8iMu3Qu12f68cL6JZmssthwHFSxLU+h9 DdF4MtDEXr+7kXPok0GElRVUEZOnNhKfmQwShjntnNy9D27SQIYPUar4C Q==; X-CSE-ConnectionGUID: oiThnxBWRYWcwLBxvd0jHw== X-CSE-MsgGUID: ksH9N37mTneimdfrXYWW2w== X-IPAS-Result: A0BKAgCRt9Fq/4r/Ja1aHgE8DA4LgVmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx3gXkzgQGDKQE/AgJAAVDYSxBvgWgBCxQBgTiFQIgjXRgBhHwnG4FJRIEVg2mBBYFcAQECiCMEgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghg7Ej0bCS0BK4JKBqVRoQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBRwsHMxoIGxWDIglKGQ+OOYNrgX+DZch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:G2znKqrn1ABG5XGkpvgY1h270rpeBmJPZBIvgKrLsJaIsI4StFCzt garIBmDOvvZZGL2ed0kYIjg/RwC78XdxodgSgY9/3hkFClH8ePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0uF2PWFI5 dYnEgEyZQ+nrfKozOq5avY506zPLOGzVG8ekmtrwTecCbMtRorOBv2To9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5MWPrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUH58KwRjCz o7A12fiIkA8b4Oa9TyI83egiPX/rBzEAp1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmcHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:OqHtIagyri2vaPheie29L101sHBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:lvU4c2t4DUmyzrff6NGIWUu46Isic0Hdymf6HHWJNm12bJeFV1PI+oN7xp8= X-Talos-MUID: 9a23:EAA3NgkkHVz2ha7CgLeQdnphL+c5xf/xDXwLnJQDt8eeBR1PBG2C2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536227762" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id EC8BE18000283 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 4EF3ECBEFAB; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 08/27] python3-git: fix CVE-2026-73623 Date: Thu, 15 Oct 2026 22:40:47 -0700 Message-Id: <20261016054106.210444-9-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247938 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73623 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73623.patch | 53 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch new file mode 100644 index 0000000000..56c2582ce3 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch @@ -0,0 +1,53 @@ +From 3621c3099fef859e91f9f960707902018a370978 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:43:26 +0200 +Subject: [PATCH] fix: reject unsafe clone templates + + + +Treat git clone --template as unsafe because caller-controlled +templates can install hooks that execute during clone. + +Add regression coverage for both direct option and keyword forms. + +References GHSA-6p8h-3wgx-97gf. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73623 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI + source archive does not include the test suite and + the python3-git recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit ffcb5359e87619f4fe4a70a4aff5f08c5580ba97) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index d661f036..2776c19e 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -148,6 +148,8 @@ class Repo: + # Can override configuration variables that execute arbitrary commands: + "--config", + "-c", ++ # Can install hooks that execute during clone: ++ "--template", + ] + """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. + +@@ -158,6 +160,9 @@ class Repo: + The ``--config``/``-c`` option allows users to override configuration variables like + ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt ++ ++ The ``--template`` option can install hooks that execute during clone: ++ https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory + """ + + unsafe_git_archive_options = [ diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 551b47fc39..d996d4f9f5 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -29,6 +29,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ + file://CVE-2026-73623.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101002 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 656C5CCF2CC for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15276.1792129269007115955 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=gZvETD6p; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6995; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=oMeAbSmsGV+yileMUlLuRUD1DkWsWc+DcWoZsAN+MYY=; b=gZvETD6pZayI0d5IESYpB4Z2Rh5zYVwbc3ujiX1VGY9Vhy/RWpP0gtv2 oj++fsNP27vMTzWgd238E1m8I/94KhVYtCw7/l/4fi1hIMVgOqYIPremX bVrDa0ec9fVh2kG0k2MNqjFxkzJZXnquQ/UQZpwH7xan3+DxtRimFXO+n cT613r7Ptxt19RN4J6vJG/S0ohTMKiAPyQMhacfympcGNp7qUEoohU/52 1l+1H4hGEMD1tFl9CU6GWmbXZ/3fIjuSvr9gWQnZb1bWCl5jXAG2u/Qv2 Gim1lgRrKmZGc5Gw/N9WrwM4RL5vWaB3rMmC5dQJ0642ULnoIcL88M6Zy w==; X-CSE-ConnectionGUID: hXmzN0rWRKG/P411Q3OArA== X-CSE-MsgGUID: 6ZyCUlS5Tr26OopRQfImaw== X-IPAS-Result: A0BIAgCGuNFq/5D/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYMZgWMnG4FJRIEVg2mBBYFcAQGIJQSDHBKBWoEDhzaNDkiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImTTEMPhMBK4JQJwOSaJI/oQ+EKIwilToaM4QEgVeSQJJUC5h9jgqWT4RpgWg8gUcLBzMaCBsVO4JnCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:0JdFF6yGHb6lryqJnWt6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkVVn TMcCGrSbPzbYzP9etpya4/g/RkBsJ+GyN9nSlNq+1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJEEGOJ8+ovxIO0Jhs sREcWk0NTeqncvjldpXSsE07igiBNPgMIVavjRryivUSK55B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cP3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzaICJK43RLSlTthiqt 0n7+1+kPgtAavuY0QC8/FOpj/CayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1nfDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:NS5fv6xklcNaJHHDCeQQKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:g6KbI2pTDxb1zjoOr43AqtrmUcAVd2/7lG3vGWyXTl41EeSsEni54ooxxg== X-Talos-MUID: 9a23:vmMVJA+hI0XbpTwG/OgNhhGQf5la8o+TDHtQrY9c5e6DLRZJNRaYhSviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536024993" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id EE647180003C5 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 54FA5CBEFBF; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 09/27] python3-git: fix CVE-2026-73624 Date: Thu, 15 Oct 2026 22:40:48 -0700 Message-Id: <20261016054106.210444-10-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247941 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73624 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73624.patch | 139 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 140 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch new file mode 100644 index 0000000000..48e7bc8d8b --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch @@ -0,0 +1,139 @@ +From 285d6227b9132ed6bab3cc28665e87b2285757ae Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:46:13 +0200 +Subject: [PATCH] fix: guard diff output options + + + +Reject unsafe diff options before revision parsing or Git invocation so +callers cannot write command output to arbitrary filesystem paths. + +Cover commit and index diffs, including option-like revisions, and +preserve an explicit allow_unsafe_options escape hatch. + +References GHSA-fjr4-x663-mwxc. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73624 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6] + +Backport Changes: +- Omitted test/test_diff.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 1d51b891d7f236044a6aa17498ec682b63dad6e6) +Signed-off-by: Yogita Urade +--- + git/diff.py | 14 ++++++++++++-- + git/index/base.py | 18 ++++++++++++++++-- + 2 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index f89b12d9..9a1f107b 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -9,7 +9,7 @@ import enum + import re + import warnings + +-from git.cmd import handle_process_output ++from git.cmd import Git, handle_process_output + from git.compat import defenc + from git.objects.blob import Blob + from git.objects.util import mode_str_to_int +@@ -34,7 +34,6 @@ from git.types import Literal, PathLike + if TYPE_CHECKING: + from subprocess import Popen + +- from git.cmd import Git + from git.objects.base import IndexObject + from git.objects.commit import Commit + from git.objects.tree import Tree +@@ -186,6 +185,7 @@ class Diffable: + other: Union[DiffConstants, "Tree", "Commit", str, None] = INDEX, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "DiffIndex": + """Create diffs between two items being trees, trees and index or an index and +@@ -215,6 +215,10 @@ class Diffable: + applied makes the self to other. Patches are somewhat costly as blobs have + to be read and diffed. + ++ :param allow_unsafe_options: ++ If ``True``, allow options such as ``--output`` that can write to arbitrary ++ filesystem paths. ++ + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to + swap both sides of the diff. +@@ -227,6 +231,12 @@ class Diffable: + an instance of :class:`~git.objects.tree.Tree` or + :class:`~git.objects.commit.Commit`, or a git command error will occur. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) ++ + args: List[Union[PathLike, Diffable]] = [] + args.append("--abbrev=40") # We need full shas. + args.append("--full-index") # Get full index paths, not only filenames. +diff --git a/git/index/base.py b/git/index/base.py +index b8161ea5..dfe7e0dc 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -23,6 +23,7 @@ from gitdb.base import IStream + from gitdb.db import MemoryDB + + from git.compat import defenc, force_bytes ++from git.cmd import Git + import git.diff as git_diff + from git.exc import CheckoutError, GitCommandError, GitError, InvalidGitRepositoryError + from git.objects import Blob, Commit, Object, Submodule, Tree +@@ -1477,6 +1478,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + ] = git_diff.INDEX, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> git_diff.DiffIndex: + """Diff this index against the working copy or a :class:`~git.objects.tree.Tree` +@@ -1489,6 +1491,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + Will only work with indices that represent the default git index as they + have not been initialized with a stream. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) ++ + # Only run if we are the default repository index. + if self._file_path != self._index_path(): + raise AssertionError("Cannot call %r on indices that do not represent the default git index" % self.diff()) +@@ -1507,7 +1515,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + # Invert the existing R flag. + cur_val = kwargs.get("R", False) + kwargs["R"] = not cur_val +- return other.diff(self.INDEX, paths, create_patch, **kwargs) ++ return other.diff( ++ self.INDEX, ++ paths, ++ create_patch, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + # END diff against other item handling + + # If other is not None here, something is wrong. +@@ -1515,4 +1529,4 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + raise ValueError("other must be None, Diffable.INDEX, a Tree or Commit, was %r" % other) + + # Diff against working copy - can be handled by superclass natively. +- return super().diff(other, paths, create_patch, **kwargs) ++ return super().diff(other, paths, create_patch, allow_unsafe_options=allow_unsafe_options, **kwargs) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index d996d4f9f5..847bdfeab2 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -30,6 +30,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ + file://CVE-2026-73624.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100985 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8DA1CCF2C0 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15275.1792129268839428503 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=YxwBej/k; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4002; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=p4abwU/a34sChYrR88BlOl8450jdLMiMQbmZCN1Z0Q0=; b=YxwBej/ksA3F7M+WMnQyCZwZM/PJ7vssk7R1sGNMIB3pm5qTpMPSX3qr 7N3dam/13E97SurwGxFVA4wYKIMovFsMqetQH6NLLZfZSNM9Sq2ycMsqq hZC76GwKjkUoSWrn8WP3cBRWz4QTxQcXLHlwWwkhPl7vdkIaFoBU9AYRb zZKzSFIUyzbC8iF/gTxURXKIBQBPs1EXVdo/yLpsmmoGmv7vFbAycj+Aj 5bDAzhEcVYIWJmtHRmtcVOwOmtVrUxYmz22mAuWiwIjJ+YE6EY+W1Ncl5 LVf2uW4DoU9HGtC+lhNXN8IUwCP3SqCYIh03estaRCRLSIqMYTSInMTlE w==; X-CSE-ConnectionGUID: mLKfV9u5TmekSEWB9c1INA== X-CSE-MsgGUID: lQKhTyO0QjueTwW/KAnZ7w== X-IPAS-Result: A0BIAgCGuNFq/5X/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAzIBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHiCLIEBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEhH6BBYEyKgEBiCUEgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghg7Ej1RASuBQwqBARiSfZAdgiGhD4QojCKHJ44TGjOFW6UUC5h9jgqVYxxQhGmBaDyBRwsHMxoIGxWDIglKGQ+OOYNrgX+DZch2JzICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:d9q8d6txO27Meplw1XFGdIOR3efnVAFfMUV32f8akzHdYApBsoF/q tZmKTqPPKyKZjf1KI8jPIvioUJX6JbdxtdqTAtvrXpnESpBgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvra9ks21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw/8JUD18f6 KEkLT0OVT28rbO9mZOdY7w57igjBJGD0II3oHpsy3TdSP0hW52GGv+M7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtGYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIIYLVHZQLwx3wS mTu+13aAi0LE4SmyyeIzm2TwczmmxGkR9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1dFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Oxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:6iTopqo0TwCwXSODgcgBTVUaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:webwBWHSw2CmFXNsqmJi0G0aJJE4L0HYwXTrDnCSWG0waZu8HAo= X-Talos-MUID: 9a23:RxTWjAvZc2E1ymVmZM2ngAhBNPt5xPyXCl0ArYo5/OqtMx4vJGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709653" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id F060D180001CB for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 5C640CBEF6B; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 10/27] python3-git: fix CVE-2026-73622 Date: Thu, 15 Oct 2026 22:40:49 -0700 Message-Id: <20261016054106.210444-11-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247947 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73622 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73622.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch new file mode 100644 index 0000000000..c43013b9e4 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch @@ -0,0 +1,60 @@ +From 5043b75a697c0f9110d2014234831dd1bc568a60 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 15:42:44 +0200 +Subject: [PATCH] fix: prevent environment expansion in remote URLs + +Remote and submodule creation expanded environment-variable references in +caller-supplied URLs before storing them in Git configuration. This could +expose process environment values through a later network request or a tracked +.gitmodules file. + +Preserve variables literally in the remaining untrusted URL callers while +retaining Git.polish_url() expansion for intentional local-path normalization. +Add regression tests covering remote configuration and submodule configuration. + +Git baseline: git remote add and git submodule add accept URL arguments +literally; Git does not perform shell-style environment expansion on those +arguments. + +CVE: CVE-2026-73622 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162] + +Backport Changes: +- Omitted test/test_remote.py, test/test_submodule.py because the current + PyPI source archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 863417457a0633db7ea5aed4fd01e0b291a41162) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + git/remote.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index fa60bcda..43e0ec9a 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -601,7 +601,7 @@ class Submodule(IndexObject, TraversableIterableObj): + # END verify url + + ## See #525 for ensuring git URLs in config-files are valid under Windows. +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + + # It's important to add the URL to the parent config, to let `git submodule` know. + # Otherwise there is a '-' character in front of the submodule listing: +diff --git a/git/remote.py b/git/remote.py +index cafa1f84..dd892fdc 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -805,7 +805,7 @@ class Remote(LazyMixin, IterableObj): + """ + scmd = "add" + kwargs["insert_kwargs_after"] = scmd +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(url) + repo.git.remote(scmd, "--", name, url, **kwargs) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 847bdfeab2..6456031620 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -31,6 +31,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ + file://CVE-2026-73622.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100992 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 881B1CCF2C5 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15275.1792129268839428503 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=O2QRzpZ+; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4297; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=nNkvEbyzDfDierYBn/jgGe1qC3XcEH43v5enD+yamEQ=; b=O2QRzpZ+VEfW94WE36lMQ44ABb9DWfeqZDbrMlAZN6qFe4xp+uwUseL9 9wj7FLvi4Ghczd53ZEXlhpZyTDscxfFEFp+AbD0VASdg1lKcthr+sydHY bW03R2FqvLvaemjCVlmXIIfqA6GmKzX8ODdeDlZToQztxLwIfxus2n+nz EVoYQJYo7IXRU/0+oS6tD14lEcqKzTTmAPxTLctVg4VSLu7pS8Zv829ly bo14+AFx6KTePxZIakvNHkFyXVeS81nJlC+HQIwwgJz/CQjcSZ1h00R4T /IwhSy3NcY/foqVey7/nL4QqmnBUv3ETnDylB4yCVweFxJXE1nfjYzIlX Q==; X-CSE-ConnectionGUID: /1Op3I45QJSuyuYSzdeMcg== X-CSE-MsgGUID: c0ro5oE1TS2a05CVLvH0hw== X-IPAS-Result: A0BIAgCGuNFq/5X/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBgSeGfgSCDYEPEoFagQOEC5A5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BciZGBz1RARAbBIEBgTalZqEPhCiMIpU6GjOFW6UUC5h9jgqVZhxNhGmBaDyBRwsHMxoIGxU7gmcJShkPji4LC4NggX+DZWzICicyAgkyAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:p/L3qKySCyjin/5PCGJ6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkUOy msdXW3XMvfYZmP2f94lbIS3oBsH68PUzdYyQVdo+VhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJAZvGpVD27oqOEN16 O0FGQsfYh2mjO3jldpXSsE07igiBNPgMIVavjRryivUSK98B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cMnWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzb4KEJIHWLSlTtk3Av GWb+EmgPipAPYTC4gSh7FL0hvCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRulzfDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EhpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:jncVR6zS6K7Dm9pkVIQMKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:xDQjDmP64BA6OO5DH3BA7BU1Rp0cUEbA3WrhGF20BENiR+jA X-Talos-MUID: 9a23:Ob4iDw7HqwG4JhfI1QrW1vLaxoxju76pVUcgyKk94cDcaAdOHym91DSoF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709654" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id F13D7180001D3 for ; Fri, 16 Oct 2026 05:41:07 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 638E3CBEF6C; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 11/27] python3-git: fix CVE-2026-73621 Date: Thu, 15 Oct 2026 22:40:50 -0700 Message-Id: <20261016054106.210444-12-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247942 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73621 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73621.patch | 72 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch new file mode 100644 index 0000000000..bb1050645e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch @@ -0,0 +1,72 @@ +From 3186ded297a9818f887c3de47fc2f0aba6a8b298 Mon Sep 17 00:00:00 2001 +From: Sebastian Thiel +Date: Sat, 25 Jul 2026 06:27:01 +0200 +Subject: [PATCH] fix: reject unsafe output options in Commit.count + + + +Commit.count forwards keyword arguments to git rev-list but did not apply the +unsafe-option validation used by the sibling revision APIs. + +Validate forwarded options with the existing Git.check_unsafe_options helper +and retain the explicit allow_unsafe_options escape hatch. This covers +GHSA-p538-c434-8v24 without adding another option parser. + +Git baseline: git.git a23bace963 defines --output as a shared diff option +consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option +with rev-list. + +CVE: CVE-2026-73621 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2] + +Backport Changes: +- Omitted test/test_commit.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: GPT 5.6 +(cherry picked from commit 38553b6fddc7f6a667cdb45a6762343a08fc72b2) +Signed-off-by: Yogita Urade +--- + git/objects/commit.py | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/git/objects/commit.py b/git/objects/commit.py +index cc85e7dd..549e12c7 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -269,13 +269,21 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + else: + return self.message.split(b"\n", 1)[0] + +- def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int: ++ def count( ++ self, ++ paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> int: + """Count the number of commits reachable from this commit. + + :param paths: + An optional path or a list of paths restricting the return value to commits + actually containing the paths. + ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--output``. ++ + :param kwargs: + Additional options to be passed to :manpage:`git-rev-list(1)`. They must not + alter the output style of the command, or parsing will yield incorrect +@@ -284,6 +292,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + :return: + An int defining the number of reachable commits + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options ++ ) ++ + # Yes, it makes a difference whether empty paths are given or not in our case as + # the empty paths version will ignore merge commits for some reason. + if paths: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 6456031620..f712a0e699 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -32,6 +32,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ + file://CVE-2026-73621.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101001 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82341CC6B2D for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15273.1792129268347065025 for ; Thu, 15 Oct 2026 22:41:08 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=GD2GFt63; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6153; q=dns/txt; s=iport01; t=1792129268; x=1793338868; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=4k19olTJcyRnonSYzVnLFtr5ouMJ99mHhb0Vh1rOLtI=; b=GD2GFt63HS3FXKB+Nl5BRrgnMyF3PaABBZSeyw2IVbcNBEuXMT927w1+ OCm+p66U+9/4TmIgh7yg9GpdeYjGJDNGjpmJN4IU9hsQbd/odvtbf5X0Z pr3yxmGcq5mQvVUBBrk3Ravav/GxDWoHZJx9ml3966ohAgfSSdipGmPJs WccmQjTzXrpNsZNeZW6BtZ0FN4iD2cCrbwK7ZEqWrsLpa6vrlm1qHUrHK vYfjHlIUhE51Q1Lcy8XZtfm9hcyw/jHkweWpoyk734V/F52LSlqOgBtZQ IoGCpK06H6JgrrNlaW4T1mCRZCFI/8Cz3penjCQywF9NvZaG1ZKd+kgJT A==; X-CSE-ConnectionGUID: NmwOc+0dSOyh1jglQ3Eujg== X-CSE-MsgGUID: PsOXc3b+S1i0WEsIvIR4Zg== X-IPAS-Result: A0BIAgCGuNFq/4//Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBiCUEgg2BDxKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BciYtDhIBPFEBEBuCMkiTIpIFgTWfWoQojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBRwsHMxoIGxWDIglKGQ+OOYNrgX+DZch2JzICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:Nz+bXqBi5O/rdhVW/37iw5YqxClBgxIJ4kV8jS/XYbTApDJxg2MAz TdLX2mDa/+DZzahLtl0aIXi8BkF78CGyoI3OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf8hWYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE5fBxK0p1ZYEj3fd3WGNB8 cVDBS0PYUXW7w626OrTpuhEnM8vKozveYgYoHwllW+fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY0BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOl1IogOK8bIq9ltqifd5yrk3Dr CH9pmWhPTwBFcK+82a3/Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTVlOzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ22FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:X9cJ86Mt8MjiasBcTu2jsMiBIKoaSvp037BN7TEUdfU7SKKlfq yV8cjzkCWE6wr5O0tQ/OxoRpPgfZq0z/cciuMs1PWZLWvbUQCTQ72Kg7GP/9SZIU3D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:/SpTQGOIFGIxP+5Dfix400VXQsweVWzdlXXfJ3bjJHtrR+jA X-Talos-MUID: 9a23:UR1PbwrvrTLSjI7ZcRIezwl5E/djuK7tMxkMyaoroOiaFBYsCTjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536182948" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 0182D1800024C for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 6808BCBEF6D; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 12/27] python3-git: fix CVE-2026-73620 Date: Thu, 15 Oct 2026 22:40:51 -0700 Message-Id: <20261016054106.210444-13-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247934 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73620 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73620.patch | 130 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 131 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch new file mode 100644 index 0000000000..816180c2d7 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch @@ -0,0 +1,130 @@ +From cc80ea13457773907fa7843e274dca8dc7d196a5 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 05:54:27 +0200 +Subject: [PATCH] Block unsafe checkout-index and tag file options + +GHSA-3f7w-8rr8-f37f reports that caller-controlled options forwarded by +IndexFile.checkout() and TagReference.create() can make Git write to or read +from arbitrary filesystem paths. + +Add regression coverage proving the unsafe options are rejected by default while +preserving the explicit allow_unsafe_options escape hatch. Reuse GitPython's +existing option candidate normalization and unsafe-option guard at both public +API boundaries. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-checkout-index.adoc defines --prefix as prepending an output +path, and Documentation/git-tag.adoc defines -F/--file as reading a tag message +from a file. + +CVE: CVE-2026-73620 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c] + +Backport Changes: +- Omitted test/test_index.py, test/test_refs.py because the current PyPI + source archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 3af0c2516c5e18c829da30338614688f6b69b49c) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 12 ++++++++++++ + git/refs/tag.py | 13 +++++++++++++ + 2 files changed, 25 insertions(+) + +diff --git a/git/index/base.py b/git/index/base.py +index dfe7e0dc..90d4c16f 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -130,6 +130,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + index directly before operating on it using the git command. + """ + ++ unsafe_git_checkout_index_options = ["--prefix"] ++ + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") + + _VERSION = 2 +@@ -1199,6 +1201,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + paths: Union[None, Iterable[PathLike]] = None, + force: bool = False, + fprogress: Callable = lambda *args: None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Union[None, Iterator[PathLike], Sequence[PathLike]]: + """Check out the given paths or all files from the version known to the index +@@ -1225,6 +1228,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + no explicit paths are given. Otherwise progress information will be send + prior and after a file has been checked out. + ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--prefix``. ++ + :param kwargs: + Additional arguments to be passed to :manpage:`git-checkout-index(1)`. + +@@ -1248,6 +1254,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + i.e. if you want :manpage:`git-checkout(1)`-like behaviour, use + ``head.checkout`` instead of ``index.checkout``. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_checkout_index_options, ++ ) ++ + args = ["--index"] + if force: + args.append("--force") +diff --git a/git/refs/tag.py b/git/refs/tag.py +index 1e38663a..487eaa14 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -16,6 +16,7 @@ from .reference import Reference + + from typing import Any, TYPE_CHECKING, Type, Union + ++from git.cmd import Git + from git.types import AnyGitObject, PathLike + + if TYPE_CHECKING: +@@ -42,6 +43,8 @@ class TagReference(Reference): + + __slots__ = () + ++ unsafe_git_tag_options = ["--file", "-F"] ++ + _common_default = "tags" + _common_path_default = Reference._common_path_default + "/" + _common_default + +@@ -92,6 +95,7 @@ class TagReference(Reference): + reference: Union[str, "SymbolicReference"] = "HEAD", + logmsg: Union[str, None] = None, + force: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "TagReference": + """Create a new tag reference. +@@ -121,12 +125,21 @@ class TagReference(Reference): + :param force: + If ``True``, force creation of a tag even though that tag already exists. + ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--file``. ++ + :param kwargs: + Additional keyword arguments to be passed to :manpage:`git-tag(1)`. + + :return: + A new :class:`TagReference`. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_tag_options, ++ ) ++ + if "ref" in kwargs and kwargs["ref"]: + reference = kwargs["ref"] + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index f712a0e699..d47ce73d72 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -33,6 +33,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ + file://CVE-2026-73620.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100996 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C3C8CCF2C7 for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15557.1792129268905469582 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=HVriJVvf; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3654; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=qIy6giTj2ndvkXxtJtDa3PgSfgln3mhXlPiKYSEzXn8=; b=HVriJVvfGFspb8IPM5gkKAN6GJdihhtZY06tzn7eyYyZ5cRbfNkdevBX P2dDoveO3pNrhHgAh05YbdrZxJn9ljzvxatbmT3sbnychcDMyVU2+u8NF yqNbu9Sv2DCswUENS32wNph6iXL7pBnnYD5o/yn0yoPiaXn1r75amrvvv YEMcUln2VJ1pJcfqQ5teCHNizDBZ+JILo2BOCW05sZH3jnLi6C9FNBM0d syo27TfJRTYuiQTOPOzSF0LZjG66XzN1nEkSZmXynY6SPyMz8zetd9tsm RcSOHuiM3FHtn6gajducB3riaIQmhE0ceLaD3gYyyD1k+X0DYcvoQq4BA Q==; X-CSE-ConnectionGUID: sEhgEPXrTDS7lqXOp81ivg== X-CSE-MsgGUID: orqSJW1GR8eubCVGe3rS7A== X-IPAS-Result: A0ADAAAeuNFq/5X/Ja1aGgEBAQEBAQEBAQEDAQEBARIBAQEBAgIBAQEBgXwFAQEBAQsBglZ1YENJjHKHN4IhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAzIBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHiCLIEBgykBPwJDUNhLEG+BaAELFAGBOAGFP4gjXRgBhHwnG4FJRIEVg2mBBYFcAQGIJQSDHBKBWoEDlERIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJi0OEj1PAgErqCGhD4QojCKVOhozhVulFAuYfY4Klk+EaYFoPIFHCwczGggbFYMiCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:lrAqla5Jh5Kl2cVN01ECCgxRtG/GchMFZxGqfqrLsTDasY5as4F+v mQYWmGBPq2IYzeheNh1bt/go0hX6MfRx9BmGwo4qylmZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eJqAY9ctPMXty2 cdHLCk9SQjT3uOoz+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGMqFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEeUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4eIK4zWFJQ9ckCwo XjfxEbGWz4gZNGCwxG73X/3nNSQtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPAXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:hxhk8qjD4nCmjnL76uTEH11lgnBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:Wen4UWj3JD2DC1b1qTiXWVrZpzJuaVDdw1roE1WEJV02TKSlbkfAoaJ6nJ87 X-Talos-MUID: 9a23:k6fS1Aq54TfUQ1KOwX0ezzZ4LfxK3P2BMhAAjJ8theaJbjZLZB7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535598499" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 0846B180001E6 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 6CC93CBEF6F; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 13/27] python3-git: fix CVE-2026-73619 Date: Thu, 15 Oct 2026 22:40:52 -0700 Message-Id: <20261016054106.210444-14-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247943 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73619 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73619.patch | 58 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch new file mode 100644 index 0000000000..288566b891 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch @@ -0,0 +1,58 @@ +From 91f2b27eb8976ef5c663f1a0ea8180e2cf28cb10 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 06:00:59 +0200 +Subject: [PATCH] Block unsafe archive additions and bundle URI + +GHSA-539m-9xh6-q6rr reports incomplete unsafe option lists for archive inputs +and clone bundle URLs. Caller-controlled archive additions can expose or inject +filesystem content, while clone --bundle-uri can dereference an additional +caller-controlled URL. + +Extend the existing archive denylist with --add-file and --add-virtual-file, +and the clone denylist with --bundle-uri. Regression coverage exercises archive +kwargs plus both clone multi-option and keyword paths. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-archive.adoc defines --add-file/--add-virtual-file, and +Documentation/git-clone.adoc defines --bundle-uri as fetching from the supplied +URI. + +CVE: CVE-2026-73619 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca] + +Backport Changes: +- Omitted test/test_clone.py, test/test_repo.py because the current PyPI + source archive does not include the test suite and the python3-git recipe + does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 2776c19e..4b783586 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -150,6 +150,8 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", ++ # Fetches from a caller-controlled URL: ++ "--bundle-uri", + ] + """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. + +@@ -171,6 +173,10 @@ class Repo: + # Writes output to a caller-controlled filesystem path. + "--output", + "-o", ++ # Reads from a caller-controlled filesystem path: ++ "--add-file", ++ # Injects a caller-controlled path and contents: ++ "--add-virtual-file", + ] + + unsafe_git_revision_options = [ diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index d47ce73d72..d6b5cdb00e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -34,6 +34,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ file://CVE-2026-73620.patch \ + file://CVE-2026-73619.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100991 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E592CCF2C3 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15558.1792129268989783422 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bUMWCbzi; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3471; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=2fLcdWS74pwsfsphIT8e0fOEhDMJnuJ+72qyetqukhU=; b=bUMWCbziydZ+VZx3Ot+1nEeWzTHQWydGM5fmpaEWWP+skGzmB3amqEfi 7c7QH32CoNoyi5h9rYPJnFltRAfwhChepw+ISK9AXGTXypk6QUMiF8qye CLxoMCMxbDrPrPh7JwylZoRC4vq/p9shMENDPdLsAkm94X9HOzsq3n75j OxJPw42lG7j4i283ej9PjtK4qNgFOjMTQ7ln4rXcRqarmMF/6hxulnDU+ 5MvUCspSNT0vm0EkU1m/bYhcomQwXlJyLcUrzNU7HJ+2ag6FmAsPI13R0 ve4NvWKQRhu6H6JtVk2PUYxQ3ey3vLkd8KuTyJPJklSF2HoUTseGgyHmH A==; X-CSE-ConnectionGUID: XXQ9K7EYQ9Garr43Ih2BKw== X-CSE-MsgGUID: ur1QX0BLTK29HsAzsQ7PbA== X-IPAS-Result: A0BIAgCRt9Fq/4//Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx3gXkzgQGCZkMBPwICQAFQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSEfoEFgVwBAQKIIwSDHBKBWh6VKUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhNPSQtAStGlR2QHYIhoQ+EKIwilToaM4QEgVeSQJJUC5h9jgqWT4RpgWg8gUcLBzMaCBsVgyIJShkPjjmDa4F/g2XIdicyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:SJEyA67IrhTyKdDjhiZM+gxRtG/GchMFZxGqfqrLsTDasY5as4F+v mNNXWuBbqrbNzTyLt1xPNjloR5VusPSnYM3GgpkqX01Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eDb0hq8UoLFB3p NMRMipRNTGD3ciV3+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGc6FSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEUUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwaoCNIofVHJQ9ckCwu 3ifxlShKDUmF4bO6SGs4GmV2dfFtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:yeYj3qr3flN0Erem2SfYygUaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:sYb5f2hcDPohLwcME/VdIC8tZTJuQk3knVSPDn6BWElgUqfJEn6QoolHjJ87 X-Talos-MUID: 9a23:69+GNAi7hLkTrkJVxqLFH8MpKd0x2pT2ImQxss9Xm9KtJzdJZA+XpWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522003719" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 0DE0018000268 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 719BDCBEF71; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 14/27] python3-git: fix CVE-2026-76221 Date: Thu, 15 Oct 2026 22:40:53 -0700 Message-Id: <20261016054106.210444-15-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247937 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf [2] https://nvd.nist.gov/vuln/detail/CVE-2026-76221 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76221.patch | 44 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch new file mode 100644 index 0000000000..c6ebdebb5e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch @@ -0,0 +1,44 @@ +From 46f9c03ed10d25146293003791476955f8b26a73 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:57:12 +0000 +Subject: [PATCH] Reject syntax-bearing git config option names + +Restrict option names to the existing safe character set. + +CVE: CVE-2026-76221 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +(cherry picked from commit a495ccd3b547ccd60b2187215823b72a9c0188bf) +Signed-off-by: Yogita Urade +--- + git/config.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/git/config.py b/git/config.py +index 21f6e8aa..30218dba 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -75,6 +75,9 @@ See: https://git-scm.com/docs/git-config#_conditional_includes + UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") + """Characters that cannot be safely written in config names or values.""" + ++VALID_CONFIG_OPTION_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$") ++"""Pattern for option names that can be written without changing config syntax.""" ++ + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 + """Utility class wrapping base-class methods into decorators that assure read-only +@@ -876,6 +879,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "option" and isinstance(name, str) and not VALID_CONFIG_OPTION_NAME_RE.fullmatch(name): ++ raise ValueError("Git config option names may contain only letters, digits, '-', '_', or '.'") + if label == "section" and isinstance(name, str): + in_quotes = False + escaped = False diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index d6b5cdb00e..8579b298e0 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -35,6 +35,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73621.patch \ file://CVE-2026-73620.patch \ file://CVE-2026-73619.patch \ + file://CVE-2026-76221.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100993 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47286CCF2C4 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15275.1792129268839428503 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Xy4OrOlT; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4213; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=rH9xpLjwH5fohzB6Q84L/32WfavdeGGii8hRLrUf8Ws=; b=Xy4OrOlT+1ajrN3eosrfBYIz9xgAwxf0YwFvZCEPlCXjuelKV7t8RBch rqHcCocCR0dU84Xa4fLxTaorC86dpuxWbEedZtjBW0EGCmvhwrLMiLzrz WJAiuNrT9J3ABbrJUKRXS/ofjfvYfaYTpPEYimMDPFn8dxACnmU28nSFy Wk+VohDFKALM1Euvjni6MfeDYqsnZfhVAJcndgb5Hk9CAdenu+7zsPQQI NAx2p1jKw1VERzwcCOGS0LZ4s2mXIe5T/F32qUv9icZR4sRU+OXBaWJPV 4OPHuN58XRN8Zo4lV9U9yWogLpF8hNo/fi+FDeC3mnASqpMdUtssyV4ha w==; X-CSE-ConnectionGUID: hNP+KxKVRnuK7wRAriSiOA== X-CSE-MsgGUID: wPb3jF62RL2a6fcOp16Cpg== X-IPAS-Result: A0BJAgCGuNFq/5T/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8eIF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWDaYEFgVwBAYglBIMcEoFagQOUREiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhNAR4eUQEKIYEglEOSPqEPhCiMIpU6GjOqbwuYfY4Klk+EaYFoPIFHCwczGggbFTuCZwlKGQ+OOYNrgX+DZch2JzICBgMyAQEHAgcOAwuBaIRhiyEtgU8BAQ IronPort-Data: A9a23:7lK+Lq3tmdstk5uLBvbD5YRwkn2cJEfYwER7XKvMYLTBsI5bpzBUz GBLXD/SOf2CajCgfdonOd+w9E9SvMDdzYNjSVQ/3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGDGcOfq4I2dhNB3xtq uMiASoMVRGkrrfjqF67YrEEasULNsLnOsYb/3pn1zycVK9gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUiQC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsi+ayaIuLJ4HiqcN9gX6S/ WDooT7DJksTatKU7iLcrFm0ibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++NukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:4jgYXa24i0aj657zRHQj7gqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:jKAGqG2g4B1tQA4FBtaeJLxfGuYdMV7N70nqJVKbVnlTYaeUcl630fYx X-Talos-MUID: 9a23:li/mngt/5loEpmsCC82nmwlob8VGvf6ULBoEz5sNnNHdawdoNGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709655" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 4D86418000148 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 77A21CBEF72; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 15/27] python3-git: fix CVE-2026-76220 Date: Thu, 15 Oct 2026 22:40:54 -0700 Message-Id: <20261016054106.210444-16-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247949 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-76220 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76220.patch | 67 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch new file mode 100644 index 0000000000..0ea0edab95 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch @@ -0,0 +1,67 @@ +From 8f29b889df8dff1c1227dafabac0f49306d45838 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:59:57 +0000 +Subject: [PATCH] Check joined short-option values before Git execution + + +GHSA-wvpp-8hx9-p66j reports that unsafe-option checks omitted the value +joined to a one-character option when split_single_char_options was false. A +regression test reproduced the mismatch: GitPython checked only -n even though +it emitted a joined -nVALUE token that Git parses as clustered short options. + +Collect the exact joined token for unsplit one-character keyword arguments so +the existing clustered-short-option validation sees every option character. +The split form and long-option behavior remain unchanged. + +A broader audit confirmed that all guarded keyword-forwarding APIs use +_option_candidates, including clone, ls-remote, fetch, pull, push, archive, +revision, diff, checkout-index, and tag paths. Git cf5497b14 confirms repeated +short-option parsing within a joined token. Focused candidate and unsafe-option +tests pass. + +CVE: CVE-2026-76220 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541] + +Backport Changes: +- Omitted test/test_git.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 96a888f4d782cb2f80452148e48e60ce4af6d541) +Signed-off-by: Yogita Urade +(cherry picked from commit 7cb2771d0968649e57c72a1f1470d7cbb9a82758) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index e2c4bf73..9c2d5d23 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -811,13 +811,21 @@ class Git(metaclass=_GitMeta): + values = value if isinstance(value, (list, tuple)) else (value,) + if any(value is True or (value is not False and value is not None) for value in values): + key = str(key) +- options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") +- if len(key) == 1 and split_single_char_options: ++ if len(key) != 1: ++ options.append(f"--{dashify(key)}") ++ elif split_single_char_options: ++ options.append(f"-{key}") + options.extend( + str(value) + for value in values + if value is not True and value not in (False, None) and str(value).startswith("-") + ) ++ else: ++ options.extend( ++ f"-{key}" if value is True else f"-{key}{value}" ++ for value in values ++ if value is True or (value is not False and value is not None) ++ ) + return options + + class AutoInterrupt: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 8579b298e0..aece60339a 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -36,6 +36,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73620.patch \ file://CVE-2026-73619.patch \ file://CVE-2026-76221.patch \ + file://CVE-2026-76220.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101000 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1648BCCF2CA for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15273.1792129268347065025 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=SYlHLfK8; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7720; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=CJknh03RFU5NgooZnGCtQT2mQMEwqaNGRPgyDrvNUic=; b=SYlHLfK8uEJF/CHP7wxQFlT8zSBa0R6ZeXVOSwEiOQ/fDK4J1ghCJYKN u8DaHL9Xcg+nokVO+Cqioz7CiHz4AhFFvfittA2ubgZc16WKozooleM+r bSQMC7O0QAnLMvH2YZ1rJPDr4EqdiaFSQsEeC6fN9BbwsZ03RnqlmZX8P ELmet8KeFOzoXGqKVNAQnAqJTvY2NVUmfth+xzr+SHCoLf28YrBze7TKt bJyQBiTIt7m8tkMXXB/Wfxk0xkScPUvy/exAH+kOvaGzY6WvwSUeAwW19 meTdMgwZXNWYihZQp+Vy4TOwpkfjTw+YZiQ4VSlLTsNfGUiQOaxyV4xIb g==; X-CSE-ConnectionGUID: fMbq92KdSl2FSZ6IvppuAQ== X-CSE-MsgGUID: idEzQhGXQ8Wu10DgGs8SvQ== X-IPAS-Result: A0BJAgCGuNFq/5H/Ja1aglmCV3VgQ0mUKYIhA54cFIFqDwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECFhkrIwgZgwIBgjoDNwMRvHiBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIJVgWMnG4FJRIEVg2mBBYFcAQGBGS5YhgYEgxwSgVqBA0qTekiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImOwsHATxRASsEgRQIgS4skmeSQKEPhCiMIpU6GjOEBIFXiz2HA5JUC5h9jgqWT4RpgWg8gUcLBzMaCBsVO4JnCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiQACyBUgEB IronPort-Data: A9a23:9HCSIqi9rHv3hVONzCnQpJhTX161NxEKZh0ujC45NGQN5FlHY01je htvWWqHbv7bNzH1fIsgPNm29EIP6MeBz9NhQQZurH1hQ3ljpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUW3+xuUDtt+ cccch42XE6imfqu3ZuCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbE+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgp/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJIXaH5QJzy50o ErH80nrOxE1BOXP9ifcql6jqfSfpj3CDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBUCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:Vhu1RqjCVFjFQ+cjM6wOsP24FHBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:QG87fGM0vk6Y9u5DVgxt7R9OOcwedifz90WOAlGgEXtAcejA X-Talos-MUID: 9a23:q/BZsArsuFB3mnUsvIYezzBuGdVR44ueMRAyjMxel8arLnxLJQ7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536182949" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 4E6FE180001C5 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 7BE94CBEF7A; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 16/27] python3-git: fix CVE-2026-76219 Date: Thu, 15 Oct 2026 22:40:55 -0700 Message-Id: <20261016054106.210444-17-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247939 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-76219 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76219.patch | 155 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 156 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch new file mode 100644 index 0000000000..3c3f3d2930 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch @@ -0,0 +1,155 @@ +From dbf247f0779367b555b55d54941ead00e999eee6 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 09:06:40 +0000 +Subject: [PATCH] Guard read-tree index output paths + + +GHSA-4gmw-gg2m-w46p reports that caller-controlled treeish arguments could +be parsed by git read-tree as --index-output and select an arbitrary output +path. A regression test showed that from_tree reached Git instead of raising +UnsafeOptionError; the same unchecked path was reachable through reset and +both merge_tree treeish positions. + +Add the project-standard unsafe-option guard and explicit opt-out to +from_tree, merge_tree, and reset. Check positional and keyword candidates so +abbreviations and alternate forwarding forms are covered before read-tree +runs. + +A broader audit found only two read-tree sinks in the codebase; both are now +guarded, and reset delegates to the guarded from_tree path. The only remaining +index-output use is GitPython's controlled temporary index. Git cf5497b14 +confirms read-tree parses this path-taking option before tree arguments. +Focused index tests and Ruff checks pass. + +CVE: CVE-2026-76219 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32] + +Backport Changes: +- Omitted test/test_index.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 9b5dcaf85da5946dbf69dcd53f9edba08f760b32) +Signed-off-by: Yogita Urade +(cherry picked from commit f46d9d3d6f21073d312ca8ef4523bdbf43655c0f) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +diff --git a/git/index/base.py b/git/index/base.py +index 90d4c16f..a2955ec3 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -131,6 +131,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + """ + + unsafe_git_checkout_index_options = ["--prefix"] ++ unsafe_git_read_tree_options = ["--index-output"] + + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") + +@@ -256,7 +257,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + + @post_clear_cache + @default_index +- def merge_tree(self, rhs: Treeish, base: Union[None, Treeish] = None) -> "IndexFile": ++ def merge_tree( ++ self, ++ rhs: Treeish, ++ base: Union[None, Treeish] = None, ++ allow_unsafe_options: bool = False, ++ ) -> "IndexFile": + """Merge the given `rhs` treeish into the current index, possibly taking + a common base treeish into account. + +@@ -270,6 +276,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + Optional treeish reference pointing to the common base of `rhs` and this + index which equals lhs. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + self (containing the merge and possibly unmerged entries in case of + conflicts) +@@ -280,6 +289,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + yourself, you have to commit the changed index (or make a valid tree from + it) and retry with a three-way :meth:`index.from_tree ` call. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([base, rhs]), ++ unsafe_options=self.unsafe_git_read_tree_options, ++ ) ++ + # -i : ignore working tree status + # --aggressive : handle more merge cases + # -m : do an actual merge +@@ -324,7 +339,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + return inst + + @classmethod +- def from_tree(cls, repo: "Repo", *treeish: Treeish, **kwargs: Any) -> "IndexFile": ++ def from_tree( ++ cls, ++ repo: "Repo", ++ *treeish: Treeish, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> "IndexFile": + R"""Merge the given treeish revisions into a new index which is returned. + The original index will remain unaltered. + +@@ -348,6 +369,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + :param kwargs: + Additional arguments passed to :manpage:`git-read-tree(1)`. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + New :class:`IndexFile` instance. It will point to a temporary index location + which does not exist anymore. If you intend to write such a merged Index, +@@ -365,6 +389,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + if len(treeish) == 0 or len(treeish) > 3: + raise ValueError("Please specify between 1 and 3 treeish, got %i" % len(treeish)) + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates(treeish, kwargs), ++ unsafe_options=cls.unsafe_git_read_tree_options, ++ ) ++ + arg_list: List[Union[Treeish, str]] = [] + # Ignore that the working tree and index possibly are out of date. + if len(treeish) > 1: +@@ -1398,6 +1428,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + working_tree: bool = False, + paths: Union[None, Iterable[PathLike]] = None, + head: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "IndexFile": + """Reset the index to reflect the tree at the given commit. This will not adjust +@@ -1429,6 +1460,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + The paths need to exist at the commit, otherwise an exception will be + raised. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :param kwargs: + Additional keyword arguments passed to :manpage:`git-reset(1)`. + +@@ -1445,7 +1479,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + """ + # What we actually want to do is to merge the tree into our existing index, + # which is what git-read-tree does. +- new_inst = type(self).from_tree(self.repo, commit) ++ new_inst = type(self).from_tree(self.repo, commit, allow_unsafe_options=allow_unsafe_options) + if not paths: + self.entries = new_inst.entries + else: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index aece60339a..6532a8d8fe 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -37,6 +37,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73619.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ + file://CVE-2026-76219.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100988 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 012CACCF2C1 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15556.1792129268499960934 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=UnfkFAPO; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5149; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=t/vQBZjKsGxf4ZSDZPZp0GRkRX0z9Lf7/HyQ/1bNkNo=; b=UnfkFAPOIJUjn47L7RkuKnQ5jH8qi7dWSoBzOtZZfIG4zWuawAjdY29p Q36R+eP9thFi79dZ3kI6kGZVqgRPK3NBb9MfYwgU3NInoh9VXD8LTtHJb F/00xI+waW0P8xwdB4fXdgoBXTe6cmsNqfADmu5LUKU4SsamQgyHMXqB0 or5kj7QTzIMF5mHEWr2nh2OndROnHhrb+14KJpRfLpwCF2XxlDIMMi8C2 Ua1xLSLkWDblZsMrfhZPfTwrXpumzRWNBoqazNRTXx3FdYbgkz9VOPme9 u8N4tNI+g9Vj8HHyF6pe3FBe/6sEdQvCrXjwSm10UYR1tvBhGzsBdmAXz w==; X-CSE-ConnectionGUID: wrzSdSfDSV+sK77gDa+8NQ== X-CSE-MsgGUID: A/azY6ncTSC3xHRcrNhlBQ== X-IPAS-Result: A0BIAgCRt9Fq/4z/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx3gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBiCUEgg2BDxKBWh6VKUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImOxIBHh5RARAbgVp2pVGhD4QojCKVOhozhVulFAuYfY4KlTOBHIRpgWg8gSgcAwsHMxoIGxWDIglKGQ+OOYNrgX+DZch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:mBPHz69OZ1oObt5LWvm0DrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3n 2QbUGyFOP3cZzGhetxxPN/go0xVuJCExoRhTwI4+XhEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kpJ58j9t15LVpwt uc7d28CQhnA18SPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+GtbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Un1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2boCPJYPUHq25mG6x4 WvUzjr/CS0hH4eP6QCO6FSsgsX2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7CQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:kh6wXq4ApEEG/F/qNQPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:7AdVF2M+ANWYC+5DRzN1z0IvFOweTD7G7yiPLGOxSjZPcejA X-Talos-MUID: 9a23:D9PgjwYIMZxCdOBTnnjllgA8MsxU2I/1GGA3mo8gu82uDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536227763" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 5427D180001EB for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 802A9CBEF7D; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 17/27] python3-git: fix CVE-2026-76218 Date: Thu, 15 Oct 2026 22:40:56 -0700 Message-Id: <20261016054106.210444-18-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247945 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-76218 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76218.patch | 94 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 95 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch new file mode 100644 index 0000000000..4cddebea8a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch @@ -0,0 +1,94 @@ +From e9a64de6632678594079cf3e020cbaff44b31615 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 02:48:01 +0000 +Subject: [PATCH] Guard unsafe git init options + + +GHSA-9rj7-rf2p-w77r reports that Repo.init forwarded git-init +options without applying GitPython's unsafe-option policy. A regression +showed template and abbreviated option spellings reached Git without an +UnsafeOptionError and could create the destination before validation. + +Add a git-init denylist for template installation and separate Git +directory redirection, check keyword options before any path or directory +mutation, and provide the standard explicit allow_unsafe_options escape +hatch. This preserves trusted uses while rejecting untrusted forwarding by +default. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) confirmed that init and clone are the +built-in commands that consume repository template directories. Clone, +clone_from, and submodule cloning already share the guarded clone helper; +the similarly named commit option only reads a commit-message template. + +Validated with the focused init regression, the clone/init unsafe-option +suite, 185 config/Git/index/clone tests, Ruff, and basedpyright. + +CVE: CVE-2026-76218 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7] + +Backport Changes: +- Omitted test/test_repo.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7) +Signed-off-by: Yogita Urade +(cherry picked from commit 2d00b71e80c6faa95a5a93be712bb0b16d701e97) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 4b783586..fd6d660d 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -141,6 +141,14 @@ class Repo: + re_author_committer_start = re.compile(r"^(author|committer)") + re_tab_full_line = re.compile(r"^\t(.*)$") + ++ unsafe_git_init_options = [ ++ # Can install hooks that execute during later Git commands: ++ "--template", ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", ++ ] ++ """Options to :manpage:`git-init(1)` that permit unsafe code execution or I/O.""" ++ + unsafe_git_clone_options = [ + # Executes arbitrary commands: + "--upload-pack", +@@ -1345,6 +1353,7 @@ class Repo: + mkdir: bool = True, + odbt: Type[GitCmdObjectDB] = GitCmdObjectDB, + expand_vars: bool = True, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "Repo": + """Initialize a git repository at the given path if specified. +@@ -1369,6 +1378,10 @@ class Repo: + information disclosure, allowing attackers to access the contents of + environment variables. + ++ :param allow_unsafe_options: ++ Allow unsafe options to be used, such as ``--template`` and ++ ``--separate-git-dir``. ++ + :param kwargs: + Keyword arguments serving as additional options to the + :manpage:`git-init(1)` command. +@@ -1376,6 +1389,11 @@ class Repo: + :return: + :class:`Repo` (the newly created repo) + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_init_options, ++ ) + if path: + path = expand_path(path, expand_vars) + if mkdir and path and not osp.exists(path): diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 6532a8d8fe..1fadd109dc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -38,6 +38,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ + file://CVE-2026-76218.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100998 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00381CCF2C8 for ; Fri, 16 Oct 2026 05:41:19 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15557.1792129268905469582 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=BtY8pr4O; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8380; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=UlRj9A0ArJZS4Z83Q2oYwAXwMFvylEkQa2Lx9auh8WI=; b=BtY8pr4OigujGEwKPZi2ADEn+hOgFn6GD4Vgd8PM/Cu8gEtlFfX6+rKD nBleuwz1N5P19GB2f5yroAVTV+HjDNGTr5czO94Hfeh+4UiDuepcMNlIG ERsNVWSrac9Bmzn/k1aCHhfdeLHxG7xUI14Xei+ZqrWRR+ZZwaQ2DXOOh cH6XUJXDRD5GoAxGGnnQXc6nycNZKi8xt4t9pSAXJ4VY4cWYhGTcbpLYR u092Q4K8LRYjpUlY3WnQttyufZLH3dqB9wrsrsoDHtBRQxCRIAJrjUKCN om13Kh8D5FIy4iPOnrHloPEN2+L8diGxWoIoExgjSu61FAanfkKB6GjX0 w==; X-CSE-ConnectionGUID: A+bMjGT7SMKn6zFVn35U5A== X-CSE-MsgGUID: 4krKbRYjRE2i26ghpg2Zrw== X-IPAS-Result: A0BJAgAeuNFq/5T/Ja1aglmCV3VgQ0kDlCaCIQOeHBSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRRrwygXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBgScghl4Egg2BDxKBWoEDhAuQOUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImOwsHATwfHxMBEBuBeAUBDSYKAgIRkxGSQKEPhCiMIpU6GjOFW6UUC5h9jgqWAk2EaYFoPIEoGwQLBzMaCBsVO4JnCUoZD16NW4NrgX+DZch2JzICBgMyAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:YMKRUKnBoD45hD/dcOtbjP3o5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJKDTyDO6reZTP0Kd8ga9u//RsHvMTTnIdmSQNs/yo8QltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FaRb8MN1Ll0Rz tk7Lm4fQC6F3L+LnZvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMmaBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTaj/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYGIJ43aGJ0P9qqej j7F5UfzOCAYDvHFyGDb/XK0ibX9hzyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzFCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:iUjh4q3ZkV7aIg8cRa+QVAqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:R21P2228eRZ6G2LDiKQCVLxfM4MvV3/y8CjrBmy+V3RHdrvOFGLN0fYx X-Talos-MUID: 9a23:K3s9aQzVul6yT0aoeyTaW23DXW2aqPitEmMHq6QEgeTeNHYuNDeFg26FWJByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535598502" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 5676D18000176 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 882E7CC4D0E; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 18/27] python3-git: fix CVE-2026-76217 Date: Thu, 15 Oct 2026 22:40:57 -0700 Message-Id: <20261016054106.210444-19-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247951 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-76217 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76217.patch | 179 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 180 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch new file mode 100644 index 0000000000..ef672de44e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch @@ -0,0 +1,179 @@ +From c99cba55c8ad6eff105ee61b15f7c683e7e4d878 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 03:18:54 +0000 +Subject: [PATCH] Guard pathspec file inputs in high-level commands + + +GHSA-hh9p-6wh2-4mfc reports that high-level rm and checkout wrappers +forwarded pathspec file options without GitPython's unsafe-option policy. +A regression showed that both commands surfaced multi-line pathspec data in +Git errors, while reset consumed the same caller-selected file without a +validation error. The audit also found that reset's positional commit could +carry the option before its argument separator. + +Define one shared unsafe pathspec-file option list and apply it to +IndexFile.remove, Head.checkout, and HEAD.reset before invoking Git. Check +reset's positional commit as well as keyword options, retain the standard +allow_unsafe_options escape hatch for trusted callers, and cover abbreviated +long-option spellings. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) found pathspec-file support in add, +checkout/restore, commit, reset, rm, and stash. GitPython has no arbitrary +high-level option forwarding to the other commands, and git mv does not +support this option. + +Validated with focused rejection and opt-in tests, 214 affected-module +regressions, Ruff, basedpyright, and git diff --check. + +CVE: CVE-2026-76217 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c] + +Backport Changes: +- Omitted test/test_git.py, test/test_index.py, test/test_refs.py because the + current PyPI source archive does not include the test suite and the + python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit f2550b65bf60ca087190981e2c7b6865e201f40c) +Signed-off-by: Yogita Urade +(cherry picked from commit bac80678945ff36fc5e8483a0c6af756a27173fa) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 6 ++++++ + git/index/base.py | 10 ++++++++++ + git/refs/head.py | 27 ++++++++++++++++++++++++++- + 3 files changed, 42 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 9c2d5d23..c509ff1a 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -421,6 +421,12 @@ + "--upload-pack", + ] + ++ unsafe_git_pathspec_from_file_options = [ ++ # Reads pathspecs from a caller-controlled file. Some commands include an ++ # unmatched pathspec in their error output, which can disclose the file. ++ "--pathspec-from-file", ++ ] ++ + def __getstate__(self) -> Dict[str, Any]: + return slots_to_dict(self, exclude=self._excluded_) + +diff --git a/git/index/base.py b/git/index/base.py +index a2955ec3..c608f2d5 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -1011,6 +1011,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + self, + items: Sequence[Union[PathLike, Blob, BaseIndexEntry, "Submodule"]], + working_tree: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[str]: + R"""Remove the given items from the index and optionally from the working tree +@@ -1041,6 +1042,10 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + physically removing the respective file. This may fail if there are + uncommitted changes in it. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-rm(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to :manpage:`git-rm(1)`, such as + ``r`` to allow recursive removal. +@@ -1052,6 +1057,11 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + This is interesting to know in case you have provided a directory or globs. + Paths are relative to the repository. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + args = [] + if not working_tree: + args.append("--cached") +diff --git a/git/refs/head.py b/git/refs/head.py +index 7e6fc337..1b82fbd3 100644 +--- a/git/refs/head.py ++++ b/git/refs/head.py +@@ -19,6 +19,7 @@ from .symbolic import SymbolicReference + + from typing import Any, Sequence, TYPE_CHECKING, Union + ++from git.cmd import Git + from git.types import Commit_ish, PathLike + + if TYPE_CHECKING: +@@ -66,6 +67,7 @@ class HEAD(SymbolicReference): + index: bool = True, + working_tree: bool = False, + paths: Union[PathLike, Sequence[PathLike], None] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "HEAD": + """Reset our HEAD to the given commit optionally synchronizing the index and +@@ -88,12 +90,21 @@ class HEAD(SymbolicReference): + Single path or list of paths relative to the git root directory + that are to be reset. This allows to partially reset individual files. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-reset(1)`. ++ + :param kwargs: + Additional arguments passed to :manpage:`git-reset(1)`. + + :return: + self + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([commit], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + mode: Union[str, None] + mode = "--soft" + if index: +@@ -238,7 +249,12 @@ class Head(Reference): + self.path = "%s/%s" % (self._common_path_default, new_path) + return self + +- def checkout(self, force: bool = False, **kwargs: Any) -> Union["HEAD", "Head"]: ++ def checkout( ++ self, ++ force: bool = False, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union["HEAD", "Head"]: + """Check out this head by setting the HEAD to this reference, by updating the + index to reflect the tree we point to and by updating the working tree to + reflect the latest index. +@@ -250,6 +266,10 @@ class Head(Reference): + If ``False``, :exc:`~git.exc.GitCommandError` will be raised in that + situation. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-checkout(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to git checkout, e.g. + ``b="new_branch"`` to create a new branch at the given spot. +@@ -265,6 +285,11 @@ class Head(Reference): + the HEAD detached which is allowed and possible, but remains a special state + that some tools might not be able to handle. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + kwargs["f"] = force + if kwargs["f"] is False: + kwargs.pop("f") diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 1fadd109dc..5f417af8cf 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -39,6 +39,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ + file://CVE-2026-76217.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100983 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4331ACCA48F for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15558.1792129268989783422 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hDh79cOV; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11038; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=MMQm4ttuvV2+tRHyWqNZyX80eFYYG3csqsugvwen/wM=; b=hDh79cOV2phPf7J+NcNN5B46ceqh2vJDe59y92bDGBDrdC2Od/Vwnpef bI/KLpVtZbtCGDnGygE1aktq49aRFm0CyC/v0Gc0sue6F4a9UqzY2+LqG Sm0ETNjQ0RD9XNYeSltUKHNoYuzsavNy+v5bVItjFwaRZ8WaQ6emlzjPv JDNCKgTMjKzOO3nhIWXfhLCh1541OtQ6MT8a7rxZ3J2GcJz0LBtT3m5ft q5Ygu1faHpikUfv6h+ifyq8P11BbPGyIg5CUEf0I9qAoz2CS13NIHQcaG qmfWsQM18/6m9ayguM1xMQ9sNSW7kRGV3h+iYNGYyJ4hslGCzbSBtRBTB g==; X-CSE-ConnectionGUID: 0evOiXvuQWW25//Gb2y0fA== X-CSE-MsgGUID: RPoQm4TGQD+XRq51pLf+mw== X-IPAS-Result: A0BJAgCRt9Fq/4v/Ja1aH4I6gld1YENJlCmCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8d4F5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEglWBYycbgUlEgRWDaYEFgVwBAYEnhn4EgxwSgVp+aIZTjQ5IgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYTT0bHAcTAQckFz+BJ1MWFJALglwBApAcgiGhD4QojCKVOhozhASBV5JAklQLmH2OCpUzNGiEaYFoPIFHCwczGggbFYMiCUoZD445g2uBf4JRgRTIdicyAgkyAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:UdlAv6PPC+URE2PvrR3ylsFynXyQoLVcMsEvi/4bfWQNrUor1jIFx mJMDGqAP/yLM2L2c4sgbozk8UwA7J/Wz9RlSHM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb9gmAsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj661jEmY3DZMFw9lIWzwJs tMSciFVYDnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmDS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2M0PXwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVYriOC2b4CNEjCMbf9tmX+d+ l7pxki6MisDaYWH7TTG923504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvCS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:EuLILKHyTCI6brk4pLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:b7/Rb299TUQkCO/fh7yVvxYZBOckQmPA9UjveRL/TkljEqzNR3bFrQ== X-Talos-MUID: 9a23:m+n7Dwtmr7xtpBe89c2nvgllDcI034uXJAM9q4xb4tGgO291JGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522003720" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 59D1818000223 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 902FCCC1611; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 19/27] python3-git: fix CVE-2026-76222 Date: Thu, 15 Oct 2026 22:40:58 -0700 Message-Id: <20261016054106.210444-20-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247950 This patch applies the upstream fix as referenced in [4], using the commit shown in [1], regression fix in [2] and follow-up fix in [3]. [1] https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06 [2] https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd [3] https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c [4] https://nvd.nist.gov/vuln/detail/CVE-2026-76222 Signed-off-by: Yogita Urade --- .../CVE-2026-76222-regression.patch | 39 ++++++ .../python3-git/CVE-2026-76222_p1.patch | 120 ++++++++++++++++++ .../python3-git/CVE-2026-76222_p2.patch | 47 +++++++ .../python/python3-git_3.1.43.bb | 3 + 4 files changed, 209 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch new file mode 100644 index 0000000000..e5e46d4b93 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch @@ -0,0 +1,39 @@ +From b324c831cbc02c82b99c18113b622d03539d23cd Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 11:07:02 +0200 +Subject: [PATCH] Initialize submodule repository before handled failures + + +Direct recursive updates with keep_going could swallow an invalid-name +validation error and then access mrepo before assignment. Reproduce that +path and initialize mrepo before validation so recursion is safely skipped. + +Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a +validates submodule paths before operating on them. + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd] + +Backport Changes: +- Omitted .basedpyright/baseline.json and test/test_submodule.py because the + current PyPI source archive does not include these development files, and the + python3-git recipe does not run the test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b324c831cbc02c82b99c18113b622d03539d23cd) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 658259cd2..9b1eb0e02 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -743,4 +743,2 @@ +- # To keep things plausible in dry-run mode. +- if dry_run: +- mrepo = None ++ mrepo = None + # END init mrepo diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch new file mode 100644 index 0000000000..0c0f54e3e5 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch @@ -0,0 +1,120 @@ +From 3f48614f5b02f67daf311a6681e6e5090a7f7dc3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sat, 1 Aug 2026 04:47:40 +0200 +Subject: [PATCH] Validate submodule names before filesystem operations + + +Submodule names read from .gitmodules can influence the separate Git directory +path. Reject empty names, absolute or drive-qualified names, and parent +components with either path separator. + +Validate before constructing module paths and before opening or mutating +existing checkouts, so a repository initialized by an older vulnerable version +cannot bypass the guard. Validate programmatic add and rename inputs before +making changes as well. + +Advisory: GHSA-hmq2-w58f-27jc + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source archive + does not include the test suite, and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit e4b8e7d026ca6abb4cf604f8e77093432ce23c06) +Signed-off-by: Yogita Urade +(cherry picked from commit 14bdaeca511c6ba89f91d4d416f69c1efbcf204f) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 43e0ec9a..a4e0077c 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -6,6 +6,7 @@ __all__ = ["Submodule", "UpdateProgress"] + import gc + from io import BytesIO + import logging ++import ntpath + import os + import os.path as osp + import stat +@@ -300,10 +301,21 @@ class Submodule(IndexObject, TraversableIterableObj): + parser.set_submodule(self) + return SectionConstraint(parser, sm_section(self.name)) + ++ @classmethod ++ def _validated_name(cls, name: str) -> str: ++ if ( ++ not name ++ or name.startswith(("/", "\\")) ++ or ntpath.splitdrive(name)[0] ++ or ".." in name.replace("\\", "/").split("/") ++ ): ++ raise ValueError("Invalid submodule name %r" % name) ++ return name ++ + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", name) ++ return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() +@@ -516,6 +528,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise InvalidGitRepositoryError("Cannot add submodules to bare repositories") + # END handle bare repos + ++ cls._validated_name(name) + path = cls._to_relative_path(repo, path) + + # Ensure we never put backslashes into the URL, as might happen on Windows. +@@ -733,6 +746,8 @@ class Submodule(IndexObject, TraversableIterableObj): + # END init mrepo + + try: ++ self._validated_name(self.name) ++ + # ENSURE REPO IS PRESENT AND UP-TO-DATE + ####################################### + try: +@@ -999,6 +1014,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("You must specify to move at least the module or the configuration of the submodule") + # END handle input + ++ self._validated_name(self.name) + module_checkout_path = self._to_relative_path(self.repo, module_path) + + # VERIFY DESTINATION +@@ -1139,6 +1155,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Need to specify to delete at least the module, or the configuration") + # END handle parameters + ++ self._validated_name(self.name) + # Recursively remove children of this submodule. + nc = 0 + for csm in self.children(): +@@ -1365,6 +1382,9 @@ class Submodule(IndexObject, TraversableIterableObj): + if self.name == new_name: + return self + ++ self._validated_name(self.name) ++ self._validated_name(new_name) ++ + # .git/config + with self.repo.config_writer() as pw: + # As we ourselves didn't write anything about submodules into the parent +@@ -1412,6 +1432,7 @@ class Submodule(IndexObject, TraversableIterableObj): + If a repository was not available. + This could also mean that it was not yet initialized. + """ ++ self._validated_name(self.name) + module_checkout_abspath = self.abspath + try: + repo = git.Repo(module_checkout_abspath) diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch new file mode 100644 index 0000000000..f498cc22c2 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch @@ -0,0 +1,47 @@ +From 4a0dfd9b336dd9332b347c3af8e8ec536017d863 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 10:08:41 +0200 +Subject: [PATCH] Validate submodule names on every module path branch + + +_module_abspath only validated names when Git used separate gitfile +submodule directories, so legacy Git behavior could accept the same invalid +name. Validate before selecting the Git-version-dependent path branch and +cover the legacy branch explicitly. + +Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a +validates submodule paths before filesystem operations. + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4299c990e1ca21896f9485277caf7bb0ae5b404c) +Signed-off-by: Yogita Urade +(cherry picked from commit 8d0b9b6ab8dea412499e21fb65a4e9eacb0a5ae0) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index a4e0077c..d25df367 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -314,8 +314,9 @@ class Submodule(IndexObject, TraversableIterableObj): + + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: ++ name = cls._validated_name(name) + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) ++ return osp.join(parent_repo.git_dir, "modules", name) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 5f417af8cf..80d52f46d0 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -40,6 +40,9 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ file://CVE-2026-76217.patch \ + file://CVE-2026-76222_p1.patch \ + file://CVE-2026-76222-regression.patch \ + file://CVE-2026-76222_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:40:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100987 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85FABCCA490 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15557.1792129268905469582 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=anb9izss; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8519; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ftP6Fv6ZOpAx0fk8dezKgu/huLOiE0jQBcqpziBmAXA=; b=anb9izssaN8AW9IBWApjGjtxP5RGIQyq2WxFDSt8TEaV4P4uCUGNtfPI gTzh5agEarnA73ITlztG3DHWZSJAqThY7iRUBDxTjgIeeC+li8YWd6Z9b v0CGTgpgOvbmdhi+ALrqukysLlWD6zJqxTlbx+dNT+Su3zJEim3TJChdc JaxY6KflEI+QEAwlgPqMizgcISwBVk4JxqDXomCD3MYq9XOVYQBCTBL9G 22+pPqQiJq0CfZVC0gMnaqWDhae4d3msLvQD12mrStDlUt4lOgEzo/xam Z/4F1DAs+wtRKVOYTZRQrsd+lWghvBLLjUP8iN7RUPSQ5f5PN8r6ZD6BQ A==; X-CSE-ConnectionGUID: q2scpTKeTIe6mzatXPaP1w== X-CSE-MsgGUID: f4WePJXhTQWd4TLTaXYz3Q== X-IPAS-Result: A0BJAgAeuNFq/5P/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8eIF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEglWBYycbgUlEgRWDaYEFgVwBAYglBIINgQ8SgVqBA5RESIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BciYtDhJjKwErBIJEBiylJ6EPhCiMIpU6GjOEBIFXkkCSVAuYfY4KlTpITYRpgWg8gUcLBzMaCBsVO4JnCUoZD44rDguDYIF/g2XIdicyAgYDMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:hwSClqqOyuvfN/vwoflvOk8p7PNeBmJPZBIvgKrLsJaIsI4StFCzt garIBmCO/6KYzCkeIx2PtzgoU8H7JfQzYRkHFA5qik8FipAo+PIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0v8tGmpWy d8VFBEAMBWRjv6G+LuDE/Y506zPLOGzVG8ekmtrwTecCbMtRorOBvySo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LV/rSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fXGJQFwx7Bz o7A12qlPRwiFuyf9QO6/i6QotPGrRLpA7tHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2YHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:02w3r688q2zh5Jjsm8huk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:Ql1NH2ms4f5UzbPeg36EhdfQSW3XOWSH13zIH2y1NUdkFriHQEOgwKpcytU7zg== X-Talos-MUID: 9a23:VeX7PgZWcSdAxuBTuWPTiQlABMdU2puiVHwprZw2itvfDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535598501" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 59BE718000243 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 97020CC8C85; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679 Date: Thu, 15 Oct 2026 22:40:59 -0700 Message-Id: <20261016054106.210444-21-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247948 This patch applies the upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78678 [3] https://nvd.nist.gov/vuln/detail/cve-2026-78679 Signed-off-by: Yogita Urade --- .../CVE-2026-78678_CVE-2026-78679.patch | 181 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 182 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch new file mode 100644 index 0000000000..a62a069718 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch @@ -0,0 +1,181 @@ +From 51216053bd6885b546be8e9ed2e8e1000e7ee5a3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Wed, 5 Aug 2026 04:48:36 +0200 +Subject: [PATCH] Block file-reading Git options + + +Reject file-reading options passed to blame, diff, and tag APIs. Inspect +positional values after resolving aliases, recognize unsafe options +behind command-specific short-flag clusters, and retain the explicit +allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and +GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink. + +Regression tests cover long, short, and clustered options, incremental blame, +tag path/reference positionals, the ref keyword alias, both diff entry points, +and preservation of diff pickaxe behavior. + +Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options. + +CVE: CVE-2026-78678 CVE-2026-78679 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6] + +Backport Changes: +- Omitted test/test_diff.py, test/test_refs.py, test/test_remote.py, + test/test_repo.py because the Wrynose PyPI source archive does not include + the test suite and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 4 +++- + git/diff.py | 7 ++++--- + git/index/base.py | 3 ++- + git/refs/tag.py | 10 ++++++---- + git/repo/base.py | 24 ++++++++++++++++++++---- + 5 files changed, 35 insertions(+), 13 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index c509ff1a..ddab399e 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -743,7 +743,9 @@ class Git(metaclass=_GitMeta): + return dashify(option_tokens[0]) + + @classmethod +- def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: ++ def check_unsafe_options( ++ cls, options: List[str], unsafe_options: List[str], clusterable_short_options: str = "46flnqsv" ++ ) -> None: + """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. + + In addition to exact matches, this rejects abbreviated long options accepted +diff --git a/git/diff.py b/git/diff.py +index 9a1f107b..032dfb25 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -216,8 +216,8 @@ class Diffable: + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` that can write to arbitrary +- filesystem paths. ++ If ``True``, allow options such as ``--output`` and ``-O`` that can write to ++ or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to +@@ -234,7 +234,8 @@ class Diffable: + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + args: List[Union[PathLike, Diffable]] = [] +diff --git a/git/index/base.py b/git/index/base.py +index c608f2d5..cefd6291 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -1550,7 +1550,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + # Only run if we are the default repository index. +diff --git a/git/repo/base.py b/git/repo/base.py +index 56a19dc5..d8cc5306 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -196,6 +196,19 @@ class Repo: + "-o", + ] + ++ unsafe_git_blame_options = unsafe_git_revision_options + [ ++ # These options read from arbitrary files and expose their contents through blame output. ++ "--contents", ++ "-S", ++ "--ignore-revs-file", ++ ] ++ ++ unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Reads caller-controlled order patterns from an arbitrary file. ++ "-O", ++ "--orderfile", ++ ] ++ + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") + """Represents the configuration level of a configuration file.""" +@@ -1100,7 +1113,7 @@ class Repo: + :manpage:`git-rev-parse(1)` is a valid option. + + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + :return: + Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the +@@ -1112,7 +1125,9 @@ class Repo: + """ + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ options=Git._option_candidates([rev], kwargs), ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) +@@ -1204,7 +1219,7 @@ class Repo: + :manpage:`git-rev-parse(1)` is a valid option. + + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + :return: + list: [git.Commit, list: []] +@@ -1220,7 +1235,8 @@ class Repo: + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([rev, rev_opts_list], kwargs), +- unsafe_options=self.unsafe_git_revision_options, ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} +diff --git a/git/refs/tag.py b/git/refs/tag.py +index 487eaa14..7b002f2f 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -134,15 +134,17 @@ class TagReference(Reference): + :return: + A new :class:`TagReference`. + """ ++ legacy_ref = kwargs.pop("ref", None) ++ if legacy_ref: ++ reference = legacy_ref ++ + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([], kwargs), ++ options=Git._option_candidates([path, reference], kwargs), + unsafe_options=cls.unsafe_git_tag_options, ++ clusterable_short_options="46adefilnqsv", + ) + +- if "ref" in kwargs and kwargs["ref"]: +- reference = kwargs["ref"] +- + if "message" in kwargs and kwargs["message"]: + kwargs["m"] = kwargs["message"] + del kwargs["message"] diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 80d52f46d0..18d7299ce3 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -43,6 +43,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222_p1.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ + file://CVE-2026-78678_CVE-2026-78679.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101006 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C49B5CCA473 for ; Fri, 16 Oct 2026 05:41:29 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15278.1792129282730516981 for ; Thu, 15 Oct 2026 22:41:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=h5qsk6kK; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5074; q=dns/txt; s=iport01; t=1792129283; x=1793338883; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=NY9nOfSipMT1GpbcFzMtUFiWmlTNf0c1iw0fyq1m+6w=; b=h5qsk6kKAnKI7lVmKMYcN6r0wCB8lIKP1sQ1oLbI9GtWgzMG1bI5GtXX duhPGWCM+MncaxpIdCqGZS3DBsNil8u0PL2wPsdtorDqT6SIBDJzHwxXv E55J7wUfG7tPRAHGScWk16LXdLOoYFTvjyShd/WHox9Ct0NuQ6nFfDMsH 29DQpJy1THOWb3qVZnj9kL2D2o0pGZuUqoWm6VEt/rxuc2x+YnmiXzmMT ffkK+FyigKDIYC102+q09zG7sKPMQY2kKmSpDi/CTxdSBw7e0yWTbbm7j VIfEcOhedKDpgKUGm7qj94XJWsSERrd8q35PU3j2CSBxZB3i7hAf2ld19 Q==; X-CSE-ConnectionGUID: 22ttIXX6RTesKqUssNsQ2g== X-CSE-MsgGUID: q4V8ZZ/pTEStdRz5/4zVfQ== X-IPAS-Result: A0AnAACGuNFq/5P/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKHN4IhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4AYU/iCNdGAGEfCcbgUlEgRWDaYEFgVwBAYglBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJi0OEi8OUQErVkWUP0KPZIIhgTWfWoQojCKVOhozhASBV6UUC5h9glmLMZZPhGmBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4NlyHYnMgIJMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:avUW5qhfyj1jfQ9vq225GFdGX161NxEKZh0ujC45NGQN5FlHY01je htvWGCGb/2NYGX0KN0na4uz/BhXu5XWmt41S1A5pHxhQyxjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqVCoPprIFF+q 8YkJSsudy2YnMSt+ei0H7wEasQLdKEHPasFsX1miDWcBvE8TNWaG+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgh/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIePKoTXFZkJwy50o Erfo1qpMCNdLOCy8iaJyGDxwbPdoy3CDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzFcCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:+6vqjKpQwa4Op86kGMJHjNYaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:ls3ZNG9c3640UzlAS8qVvxROBtwEQk2D9kvdOGyhNH1ybqasE1DFrQ== X-Talos-MUID: 9a23:4RlMYwvxzO3yarki082nnW1cZPVapLySJXsRna8U5o7YJxJ+AmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528058445" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 5B1AB1800025B for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 9C55ECBF201; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 21/27] python3-git: fix CVE-2026-78677 Date: Thu, 15 Oct 2026 22:41:00 -0700 Message-Id: <20261016054106.210444-22-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247958 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78677 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78677.patch | 86 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 87 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch new file mode 100644 index 0000000000..cdee200d1e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch @@ -0,0 +1,86 @@ +From 03baa6374b8769a9544292d84040b323c5f1437a Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 11:20:03 +0200 +Subject: [PATCH] Block separate git directories during clone + + +Repo.clone() and Repo.clone_from() did not reject the clone option that +redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc). +Regression coverage exercises both keyword and multi-option input through both +public clone APIs. + +Add the option to the existing clone denylist, matching Repo.init() +and the documented allow_unsafe_options contract. Git itself registers + +The Python package and Alpine test workflows failed across the submodule suite +because GitPython internally supplies --separate-git-dir when creating modern +submodule layouts. The new public clone guard correctly rejected that option, +but could not distinguish the library-generated path from caller input. + +Validate caller-provided keyword and multi-options before adding the +library-controlled metadata path, then explicitly allow the resulting trusted +clone invocation. This preserves rejection of unsafe clone_multi_options while +restoring normal submodule creation. Update the one test that intentionally +invokes Repo.clone_from() with its own separate git directory to opt in +explicitly. + +CVE: CVE-2026-78677 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d] + +Backport Changes: +- Omitted test/test_clone.py, test/test_submodule.py because the current PyPI + source archive does not include the test suite and the python3-git recipe + does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b68afff45af0f49e79a3e2d2162018986b37ad5d) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 10 ++++++++++ + git/repo/base.py | 3 +++ + 2 files changed, 13 insertions(+) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index d25df367..410f41e2 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -9,6 +9,7 @@ import logging + import ntpath + import os + import os.path as osp ++import shlex + import stat + import sys + import uuid +@@ -360,6 +361,15 @@ class Submodule(IndexObject, TraversableIterableObj): + module_abspath = cls._module_abspath(repo, path, name) + module_checkout_path = module_abspath + if cls._need_gitfile_submodules(repo.git): ++ if not allow_unsafe_options: ++ Git.check_unsafe_options(Git._option_candidates([], kwargs), repo.unsafe_git_clone_options) ++ multi_options = kwargs.get("multi_options") ++ if multi_options: ++ Git.check_unsafe_options( ++ shlex.split(" ".join(cast("Sequence[str]", multi_options))), ++ repo.unsafe_git_clone_options, ++ ) ++ allow_unsafe_options = True + kwargs["separate_git_dir"] = module_abspath + module_abspath_dir = osp.dirname(module_abspath) + if not osp.isdir(module_abspath_dir): +diff --git a/git/repo/base.py b/git/repo/base.py +index fd6d660d..56a19dc5 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -158,7 +158,10 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", + # Fetches from a caller-controlled URL: ++ # Fetches from an additional caller-controlled URI: + "--bundle-uri", + ] + """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 18d7299ce3..e2a762ab8e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -44,6 +44,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ + file://CVE-2026-78677.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101004 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE17FCCA462 for ; Fri, 16 Oct 2026 05:41:29 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15278.1792129282730516981 for ; Thu, 15 Oct 2026 22:41:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hthNkdSB; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3804; q=dns/txt; s=iport01; t=1792129283; x=1793338883; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ngeElvHCiDhLcHZ1TGNWcH1F8hyU+Au5XhOTYOu7+Ho=; b=hthNkdSB3fGsIIftUWMds3pmKjoBsqF9Zg9+7iSuTfDLe94tWt+lECzg w3nSr0hNx0OhSVOA2h7Vxz1Wl9qZrbNynxUZaJfgVTpCbgpZYwpQ0bNPZ 3nKnlGlX48uvo7DxqwZLmSh8eUNANomfZOirxteiBBy1Z2Nqk7K2UL5Jp iScppWK9UHHbQuXdxpT3br46jR+VTILob9vVOBcrMrQsu4PqK0RYFLVQt 8/prRZJ3esq+9C9D5C0EXvo+z8+jCDQZ17DlttUtQ6p/zQpDsNSxFuXu1 Q3BE8O2OAVDKDbP+NkWqwvknHQs8E19eDAXh0gg1u/gegaTUAjcMbOSGC Q==; X-CSE-ConnectionGUID: OMx9U/sNTtqN7orTd9HcIg== X-CSE-MsgGUID: rkzqku1GSzySycSc6q2aFg== X-IPAS-Result: A0BIAgCGuNFq/5P/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBgSeGfgSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGEwBLRBRASuCTiylJ6EPhCiMIpU6GjOEBIFXkkCSVAuYfY4Klk+EaYFoPIFHCwczGggbFYMiCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:i1YRJq+2iHZzdBrtUqhPDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3m 2oWWz2PbPuIYTD9LYhxYI+zpEMG78fdyddqTwJl+SxEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kRGJ1Jx6FsJ11S7 NpHLyoxYkGjjMO5lefTpulE3qzPLeHxN48Z/3UlxjbDALN/GdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0In1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW3YIKIKoDWG625mG6Cp XDf/HmgLSoIJeeOwgGOrGv2j8HAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl/BQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYS71Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:G4+P9a0YPFkLY9yMV2xM1AqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:rvwtoG3kxCSQ5Axz0hxk2rxfPeU1I0Ca11HsP1aeVmFzdLHEaVSx9/Yx X-Talos-MUID: 9a23:4FSbrQs7i9Z0ZmQtkc2nnjJwLcR1uouVGlE2gJ49sJedbyVeNGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528058446" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 5CDEE1800026E for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id A1513CBF202; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 22/27] python3-git: fix CVE-2026-78676 Date: Thu, 15 Oct 2026 22:41:01 -0700 Message-Id: <20261016054106.210444-23-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247957 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78676 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78676.patch | 54 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch new file mode 100644 index 0000000000..a897b4ee78 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch @@ -0,0 +1,54 @@ +From 5095b034dc451f3ec0c4c77c69403c8fce7eb6d7 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:22:31 +0200 +Subject: [PATCH] fix: preserve multiline config values when writing + + +GitConfigParser decoded valid multiline values into embedded newlines, but +_write() serialized those newlines as indented physical lines. Rewriting an +otherwise unchanged config could therefore change its meaning to Git. + +Serialize resident multiline values with Git-compatible escapes inside a +quoted continuation, preserving GitPython read compatibility while keeping +each option structurally intact. This addresses GHSA-284h-m62q-gf8w. + +The regression starts with an inert multiline value, performs an unrelated +write, and verifies with both GitPython and git config that it remains one +value and does not create another option. + +Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape +embedded LF as \\n rather than emitting it as a physical config line. + +CVE: CVE-2026-78676 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4b4e47fc1224e23b0c8ee7220a7192818f2e4abb) +Signed-off-by: Yogita Urade +--- + git/config.py | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index 30218dba..e8482a08 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -681,7 +681,11 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + continue + + for v in values: +- fp.write(("\t%s = %s\n" % (key, self._value_to_string(v).replace("\n", "\n\t"))).encode(defenc)) ++ value = self._value_to_string(v) ++ if any(char in value for char in '\n\t\b\\"'): ++ value = value.replace("\\", "\\\\").replace('"', '\\"') ++ value = '"%s\\\n"' % value.replace("\n", "\\n").replace("\t", "\\t").replace("\b", "\\b") ++ fp.write(("\t%s = %s\n" % (key, value)).encode(defenc)) + # END if key is not __name__ + + # END section writing diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index e2a762ab8e..fba7883c2e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -45,6 +45,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ + file://CVE-2026-78676.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100986 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F05FCCA473 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15274.1792129268537946542 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NHP3XAB9; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3543; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=4UuBPcM+uwOX+FNJprXEqdRM7BhfPNKjMMzqBOcH38s=; b=NHP3XAB9pNiIn3Qt1U+s/DHo8bcsQj4UgYi2+ID5wJf3PiictihBNkNq z9vpkYhuYv6DovavA6boBQLNshaFOu35zOK7NGgpClIIdwJ9qWb95+Zuz QiTRkI/T97FYtb1tiqziBpzELbxwdSJ3Ewrax83QmQdB9kWqNPTRjTfoL A0HVeehnVVcGTUie69DkcyyrQETeFIxZWifOOjH3p7t3N9v0CvCHIexS1 Zisp22Lhz9W/7J+L0bepuiAI3iAZZrczGQFF+jU4Nsm5gN6aCkFXUEieN LWnUjwvLe+M4DZdWG/JWeM64ACpDKbptWKEun/3Z/OvvdbVMtl62zqbRn Q==; X-CSE-ConnectionGUID: 2TZjW1eDTbO0lVCB1cfivQ== X-CSE-MsgGUID: IrYQSFuvQzu9Tuo2X6qU9g== X-IPAS-Result: A0BIAgAeuNFq/5D/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBgSeGfgSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGE09HDUBKwSBDYFpkmeSQKEPhCiMIpU6GjOEBIFXkkCSVAuYfY4Klk+EaYFoPIFHCwczGggbFYMiCUoZD445g2uBf4NlyHYnMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:L2eIUKhPYrBAjVTQc2C2M6OfX161NxEKZh0ujC45NGQN5FlHY01je htvD2yHOvqONjOjKY8iaojj90pT7MSHxtBgG1RspS00RitjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqVCxtR1PjhD2 cASD2gJUDup3um4wayCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbHOPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgt/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJIDVHZ4Fzy50o Ern5VXAOT8HKuWN1Gu573X2trHWoHL0Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBbCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:Zx/Ww62yJbmIg8FozDGJGwqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:P2fRW2AKSHCsuPj6E3NbxkwrQ80JTnf6lHPuCGXhAmhoVoTAHA== X-Talos-MUID: 9a23:0h2LmAnfgqgsmfqoIzQQdnpDLvZR2IqzFnkfjMQ6ps7eBXJpBmaS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536470389" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 5CF8318000231 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id A8B58CBF203; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 23/27] python3-git: fix CVE-2026-78675 Date: Thu, 15 Oct 2026 22:41:02 -0700 Message-Id: <20261016054106.210444-24-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247946 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78675 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78675.patch | 47 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch new file mode 100644 index 0000000000..7772aac55e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch @@ -0,0 +1,47 @@ +From eaa63265a59f069bf13384481c48fa48a25ff087 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:32:24 +0200 +Subject: [PATCH] fix: ignore includes in submodule configuration + + +Submodule configuration is read from .gitmodules, whose contents may come +from an untrusted repository. Its parser inherited merge_includes=True and +could therefore open files named by include directives during ordinary +submodule enumeration. + +Disable include merging at the SubmoduleConfigParser construction site. This +matches Repo.config_writer() hardening from 41ecc6a4 and addresses +GHSA-7833-fr7j-v32q without changing include behavior for trusted config +parsers. + +The regression points .gitmodules at a non-config file and verifies the +submodule entry remains readable without opening the included path. + +CVE: CVE-2026-78675 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit ef7568e3b317ce617eacda39b8b54dcdff8c3b5c) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 410f41e2..e37f8fa9 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -268,7 +268,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Cannot write blobs of 'historical' submodule configurations") + # END handle writes of historical submodules + +- return SubmoduleConfigParser(fp_module, read_only=read_only) ++ return SubmoduleConfigParser(fp_module, read_only=read_only, merge_includes=False) + + def _clear_cache(self) -> None: + """Clear the possibly changed values.""" diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index fba7883c2e..0d9e7b0a9d 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -46,6 +46,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ + file://CVE-2026-78675.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100980 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06DD6CCA462 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15558.1792129268989783422 for ; Thu, 15 Oct 2026 22:41:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=GAvVRn9Z; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=16700; q=dns/txt; s=iport01; t=1792129270; x=1793338870; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=OmqMAiRqm8bIIcWcj75GUuaEGHb7d7aepcY0/F9CLyY=; b=GAvVRn9ZeRd2IVt+4Qhs10Q4VXonG6jxLV5lu962gQ7G1SR/1Cr302wk vE9ccmJ/OixjWyH7/sMgcwYiutsK8M7gUnkfeMuGr5rYBDj5Z+hvGSE4a o6VNxOWXsnCI+LaidRV+YRkjiVY0aKahWEzRWAKBdKFhc4fPImjfo8TrE ZFZLrUi+r2GA7MMuDTDkHCOQbxYpGGSkOmNj5o1T+5Z15m1DS5+hmEozJ BS57lFJuVMzvXYHWZJYOCj5BboyU+urZX1fYmkP7IJHmYuo9Iv3RMMelp r3r2fb930HVk0k9B7W3LgGPRWDgRfBAxb0ZJj0BMpCt5wr/OwkReqHZ1u g==; X-CSE-ConnectionGUID: P32v5/W0QI+cM3aUiz6+0Q== X-CSE-MsgGUID: oYc05EtGTzWNcSIO+CME+Q== X-IPAS-Result: A0BLAgCRt9Fq/5P/Ja1aglmCV3VgQ0mUKYIhA5FKgVSKfhSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rHQEFCBkegmQBgjoDNwMRvHeBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBhHwnG4FJRIEVgTuCLoEFgVwBAYFGBIZbBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYOwsHATwbNgErF3oHAwUtGBMFCwMIHgwRkxQCB5I2oQ+EKIwihyeOExozhASBV5JAklQLmH2OCpUzMAQLEE2EaYFoPIEoGwQLBzMaCBsVgyIJShkPjisOC4NggX+DZch2JzICCTIBAQcCBw4DC4FokAEBJgeBTwEB IronPort-Data: A9a23:z6yXea29JxZD2x46kPbD5YRwkn2cJEfYwER7XKvMYLTBsI5bp2MCx zRKUW2FP/7fZ2XxKYslbI2x8koBu8CBzocwTQVl3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGNBpsI9Bfxb5OICJF0 KcRFTEfMFPbvrfjqF67YrEEasULNsLnOsYb/3pn1zycVK5gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUifC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsiuK1aIGKIIbiqcN9mXeT/ j/r40vFEC48P+e+7nmu11/vv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Nu0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:huW/1qmwMZx7eNiR9hsLBRF56fDpDfIA3DAbv31ZSRFFG/Fw8P re+MjzuiWbtN98YhwdcJW7Scq9qBDnhPtICPcqXItKNTOO0ADDEGgh1/qB/9SKIULDH4BmuZ uIC5IfNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:GJswK207G26ouLX04rPu57xfIpt/bCCa8y/pAgyzLD1gdbyHFxzIwfYx X-Talos-MUID: 9a23:K3AG6wknwxwR9APAo3WwdnplBcwwvomyJ3wfrrMNgOijdgdVFnSk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522003722" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 60D3118000A6D for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id ADB46CBF204; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 24/27] python3-git: fix CVE-2026-87817 Date: Thu, 15 Oct 2026 22:41:03 -0700 Message-Id: <20261016054106.210444-25-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247954 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b [2] https://nvd.nist.gov/vuln/detail/CVE-2026-87817 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-87817.patch | 394 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 395 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch new file mode 100644 index 0000000000..cb7bc322b9 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch @@ -0,0 +1,394 @@ +From cdfa4af79da77cb35c8a0a9629573eb46a8c6869 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 25 Aug 2026 04:57:29 +0200 +Subject: [PATCH] fix: prefer `.git` during repository discovery + + +GitPython considered worktree administration and bare-repository signatures +before a worktree's real .git entry. Align discovery with Git so .git files +and directories win, malformed .git files stop discovery, and candidate git +directories validate HEAD plus commondir-backed object and ref storage. This +addresses GHSA-239g-whfq-7xj9. + +Regression coverage compares ambiguous layouts with git rev-parse and rejects +invalid HEAD/.git metadata. + +Git baseline: 15c6308cf7ad276b306aa5b3ababfbdebfb1a917; setup.c +setup_git_directory_gently_1(), is_git_directory(), and validate_headref(). + +Repository validation can use GIT_COMMON_DIR for refs and objects. Preserve the +same value on Repo so later config, ref, and object access uses the directory +that made discovery succeed. + +Capture GIT_COMMON_DIR before the first repository config read so bare-state +detection uses the same metadata location as discovery. Resolve relative +environment values immediately so later working-directory changes cannot +retarget the Repo. + +Review feedback: relative GIT_COMMON_DIR left Git subprocesses resolving GIT_DIR +and GIT_COMMON_DIR from a different working directory; malformed commondir data, +empty GIT_OBJECT_DIRECTORY, and the linked-worktree signature were also handled +inconsistently. + +Pin the repository environment to resolved paths, reject invalid +metadata without consulting the process working directory, and +restore HEAD-based linked-worktree detection. Keep the loose HEAD +and dangling .git behavior because both match Git setup.c at baseline +15c6308cf7ad276b306aa5b3ababfbdebfb1a917. + +Review feedback identified that chained or self-referential .git pointers +recurse, filesystem-encoded metadata can fail text decoding, and a relative +GIT_DIR is not retained for later Git commands. + +Parse one regular, size-bounded Gitfile exactly once, decode Gitfile and +commondir paths with the filesystem codec, and retain the resolved GIT_DIR +for subprocesses. This rejects cycles like Git instead of recursing and keeps +commands stable after working-directory changes. + +Review feedback noted that a dangling commondir symlink was treated as absent, +allowing local objects and refs to validate the repository. + +Distinguish a truly missing commondir from a dangling symlink. This follows +Git's get_common_dir_noenv(), whose file_exists check uses lstat before +attempting to read the entry. + +Python 3.9 on Windows raised UnicodeDecodeError while the repository-discovery +regression test parsed invalid commondir bytes, causing the Python package test +(windows, 3.9) check to fail. + +Treat UnicodeError like an unreadable metadata file in both commondir and +gitfile parsing. Invalid bytes now make discovery reject the candidate +repository, matching Git's behavior. + +Review feedback noted that GIT_OBJECT_DIRECTORY made discovery succeed without +becoming the Repo ODB root, while a relative value could later be resolved from +the Git wrapper's different working directory. + +Resolve the environment value against the construction directory, use it as the +ODB root, and preserve the absolute value for later Git commands. The regression +moves the only object store outside the git directory and verifies access +through both GitDB and git cat-file after the original environment and current +directory are restored. + +Review feedback identified four setup mismatches: non-missing .git stat failures +could fall through to another repository, explicit GIT_DIR could be redirected +through a nested .git entry, Gitfile reads were not bounded to the stat-reported +size, and alternates ignored GIT_OBJECT_DIRECTORY. + +Match Git setup.c by bypassing discovery for an environment-selected GIT_DIR, +stopping discovery when Gitfile stat fails for reasons other than a missing +path, and reading exactly the previously observed Gitfile size. Resolve +alternates below the active ODB root so custom object stores remain internally +consistent. + +The commit review noted that treating every present GIT_DIR as explicit broke +two documented cases: an empty GIT_DIR must fall back to current-directory +discovery, while an empty Repo path must still use a nonempty GIT_DIR. + +CVE: CVE-2026-87817 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b] + +Backport Changes: +- Omitted test/test_repo.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 89 ++++++++++++++++++++++++++++++++--------------- + git/repo/fun.py | 90 +++++++++++++++++++++++++++++++++--------------- + 2 files changed, 124 insertions(+), 55 deletions(-) + +diff --git a/git/repo/base.py b/git/repo/base.py +index d8cc5306..7543e3cc 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -45,7 +45,6 @@ from git.util import ( + + from .fun import ( + find_submodule_git_dir, +- find_worktree_git_dir, + is_git_dir, + rev_parse, + touch, +@@ -227,6 +226,10 @@ class Repo: + ) -> None: + R"""Create a new :class:`Repo` instance. + ++ .. note:: ++ Repositories using reftable may be opened, but GitPython's direct reference ++ access does not support reftable. ++ + :param path: + The path to either the root git directory or the bare git repo:: + +@@ -261,7 +264,11 @@ class Repo: + :class:`Repo` + """ + +- epath = path or os.getenv("GIT_DIR") ++ git_dir_env = os.getenv("GIT_DIR") ++ object_dir_env = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir_env is not None: ++ object_dir_env = osp.abspath(object_dir_env) ++ epath = path or git_dir_env + if not epath: + epath = os.getcwd() + if Git.is_cygwin(): +@@ -285,15 +292,47 @@ class Repo: + raise NoSuchPathError(epath) + + # Walk up the path to find the `.git` dir. +- curpath = epath +- git_dir = None ++ curpath = os.fspath(epath) if epath is not None else "" ++ git_dir: Optional[str] = None ++ explicit_git_dir = not path and bool(git_dir_env) + while curpath: + # ABOUT osp.NORMPATH + # It's important to normalize the paths, as submodules will otherwise + # initialize their repo instances with paths that depend on path-portions + # that will not exist after being removed. It's just cleaner. ++ if not explicit_git_dir: ++ dotgit = osp.join(curpath, ".git") ++ try: ++ sm_gitpath = find_submodule_git_dir(dotgit) ++ except OSError: ++ break ++ if sm_gitpath is not None: ++ # Worktrees can use relative paths as of Git 2.48, so join to curpath. ++ git_dir = osp.normpath(osp.join(curpath, os.fspath(sm_gitpath))) ++ self._working_tree_dir = curpath ++ break ++ ++ # Like Git, do not fall back to a bare repository or parent directory when ++ # a non-directory .git entry exists but is not a valid gitfile. ++ if osp.exists(dotgit) and not osp.isdir(dotgit): ++ break + if is_git_dir(curpath): + git_dir = curpath ++ if osp.isfile(osp.join(curpath, "gitdir")) and osp.isfile(osp.join(curpath, "commondir")): ++ if "GIT_WORK_TREE" in os.environ: ++ self._working_tree_dir = os.getenv("GIT_WORK_TREE") ++ else: ++ # Linked worktree administrative directories store the path to ++ # the worktree's .git file in gitdir (without a "gitdir: " prefix). ++ with open(osp.join(git_dir, "gitdir")) as fp: ++ worktree_gitfile = fp.read().strip() ++ ++ if not osp.isabs(worktree_gitfile): ++ worktree_gitfile = osp.normpath(osp.join(git_dir, worktree_gitfile)) ++ ++ self._working_tree_dir = osp.dirname(worktree_gitfile) ++ break ++ + # from man git-config : core.worktree + # Set the path to the root of the working tree. If GIT_COMMON_DIR + # environment variable is set, core.worktree is ignored and not used for +@@ -313,21 +352,7 @@ class Repo: + self._working_tree_dir = os.getenv("GIT_WORK_TREE") + break + +- dotgit = osp.join(curpath, ".git") +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is not None: +- git_dir = osp.normpath(sm_gitpath) +- +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is None: +- sm_gitpath = find_worktree_git_dir(dotgit) +- +- if sm_gitpath is not None: +- git_dir = expand_path(sm_gitpath, expand_vars) +- self._working_tree_dir = curpath +- break +- +- if not search_parent_directories: ++ if explicit_git_dir or not search_parent_directories: + break + curpath, tail = osp.split(curpath) + if not tail: +@@ -338,6 +363,16 @@ class Repo: + raise InvalidGitRepositoryError(epath) + self.git_dir = git_dir + ++ common_dir_env = os.getenv("GIT_COMMON_DIR") ++ if common_dir_env is not None: ++ self._common_dir = osp.abspath(common_dir_env) ++ else: ++ try: ++ common_dir = os.fsdecode((Path(self.git_dir) / "commondir").read_bytes()).rstrip("\r\n") ++ self._common_dir = osp.join(self.git_dir, common_dir) ++ except OSError: ++ self._common_dir = "" ++ + self._bare = False + try: + self._bare = self.config_reader("repository").getboolean("core", "bare") +@@ -345,12 +380,6 @@ class Repo: + # Let's not assume the option exists, although it should. + pass + +- try: +- common_dir = (Path(self.git_dir) / "commondir").read_text().splitlines()[0].strip() +- self._common_dir = osp.join(self.git_dir, common_dir) +- except OSError: +- self._common_dir = "" +- + # Adjust the working directory in case we are actually bare - we didn't know + # that in the first place. + if self._bare: +@@ -359,9 +388,15 @@ class Repo: + + self.working_dir: PathLike = self._working_tree_dir or self.common_dir + self.git = self.GitCommandWrapperType(self.working_dir) ++ if common_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir), GIT_COMMON_DIR=os.fspath(self.common_dir)) ++ elif git_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir)) ++ if object_dir_env is not None: ++ self.git.update_environment(GIT_OBJECT_DIRECTORY=object_dir_env) + + # Special handling, in special times. +- rootpath = osp.join(self.common_dir, "objects") ++ rootpath = object_dir_env if object_dir_env is not None else osp.join(self.common_dir, "objects") + if issubclass(odbt, GitCmdObjectDB): + self.odb = odbt(rootpath, self.git) + else: +@@ -969,7 +1004,7 @@ class Repo: + The method does not check for the existence of the paths in `alts`, as the + caller is responsible. + """ +- alternates_path = osp.join(self.common_dir, "objects", "info", "alternates") ++ alternates_path = osp.join(self.odb.root_path(), "info", "alternates") + if not alts: + if osp.isfile(alternates_path): + os.remove(alternates_path) +diff --git a/git/repo/fun.py b/git/repo/fun.py +index e44d9c64..29faaf29 100644 +--- a/git/repo/fun.py ++++ b/git/repo/fun.py +@@ -57,22 +57,61 @@ def touch(filename: str) -> str: + def is_git_dir(d: PathLike) -> bool: + """This is taken from the git setup.c:is_git_directory function. + ++ .. note:: ++ This function recognizes repositories using reftable through their ++ compatibility files, but GitPython's direct reference access does not support ++ reftable. ++ + :raise git.exc.WorkTreeRepositoryUnsupported: + If it sees a worktree directory. It's quite hacky to do that here, but at least + clearly indicates that we don't support it. There is the unlikely danger to + throw if we see directories which just look like a worktree dir, but are none. + """ + if osp.isdir(d): +- if (osp.isdir(osp.join(d, "objects")) or "GIT_OBJECT_DIRECTORY" in os.environ) and osp.isdir( +- osp.join(d, "refs") +- ): +- headref = osp.join(d, "HEAD") +- return osp.isfile(headref) or (osp.islink(headref) and os.readlink(headref).startswith("refs")) +- elif ( +- osp.isfile(osp.join(d, "gitdir")) +- and osp.isfile(osp.join(d, "commondir")) +- and osp.isfile(osp.join(d, "gitfile")) +- ): ++ headref = osp.join(d, "HEAD") ++ if osp.islink(headref): ++ try: ++ valid_head = os.readlink(headref).startswith("refs/") ++ except OSError: ++ valid_head = False ++ else: ++ try: ++ with open(headref, "rb") as fp: ++ head = fp.read(256) ++ except OSError: ++ valid_head = False ++ else: ++ valid_head = (head.startswith(b"ref:") and head[4:].lstrip().startswith(b"refs/")) or bool( ++ re.match(rb"(?:[0-9A-Fa-f]{64}|[0-9A-Fa-f]{40})", head) ++ ) ++ ++ common_dir = os.getenv("GIT_COMMON_DIR") ++ if common_dir == "": ++ return False ++ if common_dir is None: ++ common_dir_file = Path(d) / "commondir" ++ try: ++ common_dir = os.fsdecode(common_dir_file.read_bytes()).rstrip("\r\n") ++ except FileNotFoundError: ++ if osp.lexists(common_dir_file): ++ return False ++ common_dir = os.fspath(d) ++ except (OSError, UnicodeError): ++ return False ++ else: ++ if not common_dir: ++ return False ++ try: ++ common_dir = osp.realpath(osp.join(d, common_dir)) ++ except (OSError, ValueError): ++ return False ++ ++ object_dir = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir is None: ++ object_dir = osp.join(common_dir, "objects") ++ if valid_head and osp.isdir(object_dir) and osp.isdir(osp.join(common_dir, "refs")): ++ return True ++ if osp.isfile(osp.join(d, "gitdir")) and osp.isfile(osp.join(d, "commondir")) and osp.isfile(headref): + raise WorkTreeRepositoryUnsupported(d) + return False + +@@ -81,19 +120,20 @@ def find_worktree_git_dir(dotgit: PathLike) -> Optional[str]: + """Search for a gitdir for this worktree.""" + try: + statbuf = os.stat(dotgit) +- except OSError: ++ except (FileNotFoundError, NotADirectoryError): + return None +- if not stat.S_ISREG(statbuf.st_mode): ++ if not stat.S_ISREG(statbuf.st_mode) or statbuf.st_size > (1 << 20): + return None + + try: +- lines = Path(dotgit).read_text().splitlines() +- for key, value in [line.strip().split(": ") for line in lines]: +- if key == "gitdir": +- return value +- except ValueError: +- pass +- return None ++ with open(dotgit, "rb") as fp: ++ content_bytes = fp.read(statbuf.st_size) ++ if len(content_bytes) != statbuf.st_size: ++ return None ++ content = os.fsdecode(content_bytes).rstrip("\r\n") ++ except (OSError, UnicodeError): ++ return None ++ return content[8:] if len(content) >= 9 and content.startswith("gitdir: ") else None + + + def find_submodule_git_dir(d: PathLike) -> Optional[PathLike]: +@@ -101,15 +141,9 @@ def find_submodule_git_dir(d: PathLike) -> Optional[PathLike]: + if is_git_dir(d): + return d + +- try: +- with open(d) as fp: +- content = fp.read().rstrip() +- except IOError: +- # It's probably not a file. +- pass +- else: +- if content.startswith("gitdir: "): +- path = content[8:] ++ path = find_worktree_git_dir(d) ++ if path is None: ++ return None + + if Git.is_cygwin(): + # Cygwin creates submodules prefixed with `/cygdrive/...` suffixes. diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 0d9e7b0a9d..29c73287c2 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -47,6 +47,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ + file://CVE-2026-87817.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100981 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19056CCA48B for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15277.1792129269763475531 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=CGZW87mF; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3479; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=T02Flo79DSG+WAe9clUXrdabHXYSOUPZMblhI4OFE0w=; b=CGZW87mFKF4RNvy+++aSKghJHRGbZD9q9T1a6vurCDQV+QyxJTcpDY1Q 9MebH+Z7Y/09CCAbvQ7QLu/zTcP71iW2eAyLu0q6l1qSCkT/q3EnuU5Bk mW+KaDM9lP9DR+pjogbwQJmJMhKGZG0NsHCiGY7p5ZLFmgZEJQdZKFkgh OcZfKt4Vw8/grWZvIssIA6c6jPQeJf8m3glTjpmxeS6GnUmYp7Vb8A7aT QD0JKx+zdQfHIekjjH/wVmIbpDRk7ohU5whQks+e/AAy83uVx85tmTkL5 QeoZHbZtZ6qtdL7PLB4TgxyxNVVoB5n8aSNZ60zUcSL/rALlfRimjcHh7 Q==; X-CSE-ConnectionGUID: TYm0/BoiRt2YC3FF8Mmy+A== X-CSE-MsgGUID: dmKyzfKyQeqfYTz6XjQUIw== X-IPAS-Result: A0BIAgCGuNFq/5L/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx4gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAEBiCUEgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImOxI9UQErggN3kleSUKEPhCiMIpU6GjOEBIFXkkCSVAuYfY4Klk+EaYFoPIEoHAMLBzMaCBsVgyIJShkPjjmDa4F/g2XIdicyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:j5zJc6NaOYdiqI/vrR3ylsFynXyQoLVcMsEvi/4bfWQNrUpw3mFUx zAXWzjQOa7ZMDD8f9l/bYu/9kIA7JLTztI2HnM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb9gmAsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj68lfCRlxF4oZwPotMEoV2 9JIDTUcLTnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmIS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMnwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVcvj+C8boeLEjCMbclQvVeKq EHXxmngDCAmJoKvywO4023504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvuS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6tV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:VwB0Ma5k6EZDV0T85gPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:DWdPSWqfk7UYdw+lxL344HnmUfwUdyWa5nDRGVPiOE0yZpPFbFqBu4oxxg== X-Talos-MUID: 9a23:/4VxQQnv9TYHl5I3CGITdnpuMeR58aqNGXkAiJs3h9vaBS5JBhaC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709656" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 62D4518000236 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id B3B4FCC8C92; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 25/27] python3-git: fix CVE-2026-87818 Date: Thu, 15 Oct 2026 22:41:04 -0700 Message-Id: <20261016054106.210444-26-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247952 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-87818 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-87818.patch | 55 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 56 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch new file mode 100644 index 0000000000..47cea66a81 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch @@ -0,0 +1,55 @@ +From 6b83f54db287f190ae29c89b36ba6aba01f7c8d6 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 17 Aug 2026 06:15:12 +0200 +Subject: [PATCH] fix: require opt-in for no-index diffs + + +Treat --no-index as an unsafe diff option because it changes path operands +from repository pathspecs to arbitrary filesystem paths. This addresses +GHSA-whh4-5q6c-9v3x without exposing advisory reproduction details. + +CVE: CVE-2026-87818 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8] + +Backport Changes: +- Omitted test/test_diff.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 09f2cf383a992d1af697364569e9f384748c1bd8) +Signed-off-by: Yogita Urade +--- + git/diff.py | 4 ++-- + git/repo/base.py | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index 032dfb25..08bd4410 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -216,8 +216,8 @@ class Diffable: + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` and ``-O`` that can write to +- or read from arbitrary filesystem paths. ++ If ``True``, allow options such as ``--output``, ``--no-index``, and ``-O`` ++ that can write to or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to +diff --git a/git/repo/base.py b/git/repo/base.py +index 7543e3cc..f2dca3c7 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -203,6 +203,8 @@ class Repo: + ] + + unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Treats path operands as arbitrary filesystem paths. ++ "--no-index", + # Reads caller-controlled order patterns from an arbitrary file. + "-O", + "--orderfile", diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 29c73287c2..9e12fb4f1e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -48,6 +48,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ + file://CVE-2026-87818.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100982 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07CACCC6B38 for ; Fri, 16 Oct 2026 05:41:17 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15275.1792129268839428503 for ; Thu, 15 Oct 2026 22:41:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=gD9p5yII; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10195; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=C3qg4eGi8QmH+wUse0UKTH4lDI9j9nOGRi66QbW02hg=; b=gD9p5yIIbqcxmUtTvHD6qTMi0GWd04wwZe33qDYjgiLMcg7tWzH1XFqD ktfysvLxiT0FXQ4uD8B7w2QOroqpsFe8iNOWNgwrwoIvPdGESyFfbaTqQ 2LpgALkByx2W1PA3MwNgChC0Er73O42NEMFF9CcXD/a6Hvzs4BuyKzDri x/xuO45Oi5YJnTIe5mVXdl4TNtQN7PxmjdX/X9SxWUHv1BVCYtqf+YFoc N+Y6mc7o/qOJFEaKeLLuMDA+6g+lFSfrMLRWP5DawTTfwmEOQOTGqZ9Gd u+MUXvcnLaBfPALjXGCRaFrqLJnirvzL6NCzmJq0FhylAkouz7Yfzlgdn A==; X-CSE-ConnectionGUID: 2jil8o37To6pR57gACsGdQ== X-CSE-MsgGUID: N8BkGIb3ThS+CoJIKpMVsA== X-IPAS-Result: A0BKAgCGuNFq/4r/Ja1RCYJZgld1YENJlCmBNWwDkx6KfhSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHiBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIQ4JxuBSUSBFYNpgQVLAYEQAQGBKwEICgEHhl8EgxwSgVqBTZN6SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BXRYlRgcBPBs2ASUGFz+BNQiTTgIIkBWCIaEPhCiMIpU6GjOEBIFXkkCSVAuYfY4KlWcxN4RpgWg8aV4LBzMaCBsVgyIJShkPjjmBY4IIgX+DZWzICicyAgkyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:cBOQpq37j6cdrDucMfbD5YRwkn2cJEfYwER7XKvMYLTBsI5bpzQOx 2cXDTiHb/2MZmKjet5/YIrgo0kG7ZPSyoRnHANv3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGVkM3Od0foblLBj9Wz 6FHJxkmdT+PvrfjqF67YrEEasULNsLnOsYb/3pn1zycVa9gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNU+QC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsi+ayaIuLJ4PiqcN9uBayp U3n9T/FAipZH9u96Bmd10y3r7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:fQuqxqEpzLN+xTFgpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:GxTQXmF9aMRRHojBqmI99k8QSsd+LUHakm/qfhC3IE1yZ7GsHAo= X-Talos-MUID: 9a23:RCKZgQ2Ce9EpwR7pt9RQAGwkizUjxfSEC28sm846u/LHHitSGhSFqQqsa9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536709657" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 63E22180001D6 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id B80FFCC8C93; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 26/27] python3-git: Fix CVE-2026-87819 Date: Thu, 15 Oct 2026 22:41:05 -0700 Message-Id: <20261016054106.210444-27-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247953 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8 [2] https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f [3] https://nvd.nist.gov/vuln/detail/CVE-2026-87819 Signed-off-by: Yogita Urade --- .../python3-git/CVE-2026-87819_p1.patch | 77 ++++++++++ .../python3-git/CVE-2026-87819_p2.patch | 139 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 2 + 3 files changed, 218 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch new file mode 100644 index 0000000000..9dfbb6ccc6 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch @@ -0,0 +1,77 @@ +From 47e0d430af6885ceeaa38a8c5517efac872b70b4 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 11 Aug 2026 14:18:25 +0200 +Subject: [PATCH] fix: parse actor identities without regular expressions + + +GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor +identity contains a long unterminated email delimiter. + +Add a regression that exercises a 20,000-character malformed identity, +then replace both actor regexes with direct delimiter scans following +Git's first-opening, first-closing delimiter behavior. Keep GitPython's +whole-string fallback when either delimiter is absent. + +Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95 +ident.c::split_ident_line and its invalid-committer cases in +t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and +lenient identity tests. + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8] + +Backport Changes: +- Omitted test/test_actor.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 751473a5f3221d6f989291cbebcc404353fd3ba8) +Signed-off-by: Yogita Urade +--- + git/util.py | 24 ++++++++---------------- + 1 file changed, 8 insertions(+), 16 deletions(-) + +diff --git a/git/util.py b/git/util.py +index 9619937c..9a698e6d 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -772,10 +772,6 @@ class Actor: + committers and authors or anything with a name and an email as mentioned in the git + log entries.""" + +- # PRECOMPILED REGEX +- name_only_regex = re.compile(r"<(.*)>") +- name_email_regex = re.compile(r"(.*) <(.*?)>") +- + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +@@ -820,18 +816,14 @@ class Actor: + :return: + :class:`Actor` + """ +- m = cls.name_email_regex.search(string) +- if m: +- name, email = m.groups() +- return Actor(name, email) +- else: +- m = cls.name_only_regex.search(string) +- if m: +- return Actor(m.group(1), None) +- # Assume the best and use the whole string as name. +- return Actor(string, None) +- # END special case name +- # END handle name/email matching ++ line = string.partition("\n")[0] ++ left_bracket = line.find("<") ++ right_bracket = line.find(">", left_bracket + 1) ++ if left_bracket >= 0 and right_bracket >= 0: ++ return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) ++ ++ # Assume the best and use the whole string as name. ++ return Actor(string, None) + + @classmethod + def _main_actor( diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch new file mode 100644 index 0000000000..a92f5e7738 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch @@ -0,0 +1,139 @@ +From 0d63f66a673cfcad25a1fd85f56177d19a1b6547 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Fri, 28 Aug 2026 08:37:50 +0200 +Subject: [PATCH] fix: restore Actor.name_email_regex (#2220) + + +GitPython 3.1.60 removed the Actor.name_email_regex class attribute while +replacing internal actor parsing, which broke downstream consumers such as +python-semantic-release. + +Bring back the historical compiled pattern for downstream compatibility, +but emit DeprecationWarning whenever the class member is accessed. The warning +explains its quadratic behavior on long malformed strings and points callers to +the public Actor(name, email) constructor when fields are separate, or direct +string parsing when they are not. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 + +Add public Actor.from_string constructor (#2220) + +Promote the existing actor identity parser to Actor.from_string while retaining _from_string as a compatibility alias. Point the name_email_regex deprecation warning to the new public constructor or Actor(name, email). + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 12 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +Co-authored-by: Codex GPT-5 + +Address review feedback about Actor subclasses + +Review feedback: Actor.from_string() should preserve the class on which the public classmethod is called instead of always returning a base Actor. + +Construct through cls on both parsing paths and cover subclass construction directly. + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 13 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +Address review feedback about constructor typing + +Review feedback: Actor.from_string() constructs subclasses at runtime but its Actor return annotation prevents type checkers from preserving subclass-specific members. + +Use the project existing Python 3.7-compatible bound TypeVar pattern so the declared return type follows cls. + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 13 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f] + +Backport Changes: +- Omitted test/test_actor.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. + +Co-authored-by: Codex GPT-5 +(cherry picked from commit bc63b027e2fc737e2ec0222bfa764e1aa76a427f) +Signed-off-by: Yogita Urade +--- + git/util.py | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/git/util.py b/git/util.py +index 9a698e6d..16cd25ef 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -80,6 +80,7 @@ from typing import ( + Sequence, + Tuple, + TYPE_CHECKING, ++ Type, + TypeVar, + Union, + cast, +@@ -108,6 +109,7 @@ from git.types import ( + + T_IterableObj = TypeVar("T_IterableObj", bound=Union["IterableObj", "Has_id_attribute"], covariant=True) + # So IterableList[Head] is subtype of IterableList[IterableObj]. ++T_Actor = TypeVar("T_Actor", bound="Actor") + + _logger = logging.getLogger(__name__) + +@@ -767,11 +769,27 @@ class CallableRemoteProgress(RemoteProgress): + self._callable(*args, **kwargs) + + ++class _DeprecatedActorNameEmailRegex: ++ _pattern = re.compile(r"(.*) <(.*?)>") ++ ++ def __get__(self, _instance: Any, _owner: Any) -> Pattern[str]: ++ warnings.warn( ++ "Actor.name_email_regex is deprecated and will be removed in GitPython 4.0.0 because searching long " ++ "malformed strings with it can take quadratic time. Use Actor.from_string() to parse actor identities, " ++ "or Actor(name, email) when the fields are already separate.", ++ DeprecationWarning, ++ stacklevel=2, ++ ) ++ return self._pattern ++ ++ + class Actor: + """Actors hold information about a person acting on the repository. They can be + committers and authors or anything with a name and an email as mentioned in the git + log entries.""" + ++ name_email_regex = _DeprecatedActorNameEmailRegex() ++ + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +@@ -805,7 +823,7 @@ class Actor: + return '">' % (self.name, self.email) + + @classmethod +- def _from_string(cls, string: str) -> "Actor": ++ def from_string(cls: Type[T_Actor], string: str) -> T_Actor: + """Create an :class:`Actor` from a string. + + :param string: +@@ -820,10 +838,12 @@ class Actor: + left_bracket = line.find("<") + right_bracket = line.find(">", left_bracket + 1) + if left_bracket >= 0 and right_bracket >= 0: +- return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) ++ return cls(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) + + # Assume the best and use the whole string as name. +- return Actor(string, None) ++ return cls(string, None) ++ ++ _from_string = from_string + + @classmethod + def _main_actor( diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 9e12fb4f1e..13bcc5bbdc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -49,6 +49,8 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ file://CVE-2026-87818.patch \ + file://CVE-2026-87819_p1.patch \ + file://CVE-2026-87819_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Oct 16 05:41:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100989 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D412CCF2C2 for ; Fri, 16 Oct 2026 05:41:18 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15558.1792129268989783422 for ; Thu, 15 Oct 2026 22:41:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fojo/DOY; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5175; q=dns/txt; s=iport01; t=1792129269; x=1793338869; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=LxC5sfxTrLmA6qNHO+5kACbzoOHYTIeiqhAbToYp3pI=; b=fojo/DOYsB0D8vg95bhlCkyMAtZztrR3jEytuDGMFAToJsi3z2LTlxAw nYlYBsHiILe6KDl50Qi5ktlu6H9q7rlcp/lO8o2LLLPoCRYQFEYsV6b31 oQWy3Hz/HI2EkqOr25p/kRWUJ1P/SKhyy3RIj8GCzyUJN/52jFRwEacMv j+LyYCDGRHyG5e39BMgPeyuKUNaUud28K8cgp9X6Guoe8plFPyPdTepIA aY603YCFScAHpGP3sGCRSKvqdQxufTf43Jg2lR81YUWVILlrGkLXZM5Rf VkHPr/2QJumbggG1KEKnqUAlfRZc6VHNeHs1R5Ne6ROoSKMn2qdFrP5Pf A==; X-CSE-ConnectionGUID: qtjDCjqTQv+ljqbq2LpuLQ== X-CSE-MsgGUID: XSXH+MqLT9Cr+rQ7ZuK+ew== X-IPAS-Result: A0BJAgCRt9Fq/4r/Ja1aglmCV3VgQ0mUKYIhA5Mein6Bfg8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHeBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIJVgWMnG4FJRIEVgReCUoEFgVwBAYglBIINgQ8SgVqFDpA5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGE0BgQ0BKxc5gR0LQxMYknsKkjahD4QojCKVOhozhASBV5JAklQLmH2CWYsxlk+EaYFoPIFHCwczGggbFYMiCUoZD44uCwuDYIF/g2VsyAonMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:zm//aa65KSh189ICDH7DsQxRtG/GchMFZxGqfqrLsTDasY5as4F+v mscC2uEM6yCZWP2et5xaozl/UpS7Z+Gn9dmTgRkqCljZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eJJEa1s11GF136 78cKikHd0qnn/+S+efuIgVsrpxLwMjDJogTvDRkiDreF/tjGcmFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkYfUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwaoCNIofVH5w9ckCwl ln23yfcGzUmZfeFiiC8rUCxpazCgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:n9Sdq6FLO7tEHuWCpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:8GLfBWkrLD5DduB/pspdDAKXp8rXOWTBzlv7IVaEMHgqTL+MQ0bK3Lt5t/M7zg== X-Talos-MUID: 9a23:kTzeUww8PeGEYytwC2ONZb+OJ4maqJSVOGBOtIwih5ivL29qAmivkRf0T5Byfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522003721" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:41:08 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 64D4918000283 for ; Fri, 16 Oct 2026 05:41:08 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id BC46DCC8C94; Thu, 15 Oct 2026 22:41:07 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][PATCH 27/27] python3-git: fix CVE-2026-100689 Date: Thu, 15 Oct 2026 22:41:06 -0700 Message-Id: <20261016054106.210444-28-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016054106.210444-1-yurade@cisco.com> References: <20261016054106.210444-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:41:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247944 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-100689 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-100689.patch | 90 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch new file mode 100644 index 0000000000..a94711d690 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch @@ -0,0 +1,90 @@ +From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 1 Sep 2026 11:33:19 +0200 +Subject: [PATCH] Reject submodule checkout paths outside the repository + +GHSA-59cr-6r3x-644w identifies that submodule update paths could reach +filesystem operations without the containment check already used by add and +move. + +Add a regression that proves update rejects a parent-directory checkout +path before cloning, and override Submodule.abspath to apply the shared +_to_relative_path guard for every filesystem consumer. + +Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index +paths, covered for parent traversal by t/t9300-fast-import.sh. + +CVE: CVE-2026-100689 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093] + +Backport Changes: +- Strengthened the 3.1.43 _to_relative_path implementation to normalize + paths and verify commonpath containment; its prior prefix check did not + reject relative parent-directory traversal. +- Omitted doc/source/changes.rst because it only records the release note. +- Omitted test/test_submodule.py because the PyPI source archive does not + include the test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 46 +++++++++++++++++++++++++++++------------ + 1 file changed, 33 insertions(+), 13 deletions(-) + +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -400,19 +400,39 @@ + path = path[:-1] + # END handle trailing slash + +- if osp.isabs(path) and parent_repo.working_tree_dir: +- working_tree_linux = to_native_path_linux(parent_repo.working_tree_dir) +- if not path.startswith(working_tree_linux): +- raise ValueError( +- "Submodule checkout path '%s' needs to be within the parents repository at '%s'" +- % (working_tree_linux, path) +- ) +- path = path[len(working_tree_linux.rstrip("/")) + 1 :] +- if not path: +- raise ValueError("Absolute submodule path '%s' didn't yield a valid relative path" % path) +- # END verify converted relative path makes sense +- # END convert to a relative path +- ++ root = parent_repo.working_tree_dir ++ if root: ++ drive, tail = osp.splitdrive(path) ++ separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep) ++ if drive and not tail.startswith(separators): ++ raise ValueError("Drive-relative path %r is not supported" % path) ++ ++ root_abs = osp.abspath(to_native_path_linux(root)) ++ path_abs = osp.abspath(osp.join(root_abs, path)) ++ try: ++ common_path = osp.commonpath([root_abs, path_abs]) ++ except ValueError as e: ++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) from e ++ if osp.normcase(common_path) != osp.normcase(root_abs): ++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) ++ ++ path = to_native_path_linux(osp.relpath(path_abs, root_abs)) ++ ++ if not path or path == ".": ++ raise ValueError("Submodule checkout path must not be the repository root") ++ ++ return path ++ ++ @property ++ def abspath(self) -> PathLike: ++ root = self.repo.working_tree_dir ++ if root is None: ++ return super().abspath ++ path = root ++ for component in self._to_relative_path(self.repo, self.path).split("/"): ++ path = join_path_native(path, component) ++ if osp.islink(path): ++ raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path) + return path + + @classmethod diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 13bcc5bbdc..79baf0aacc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -51,6 +51,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-87818.patch \ file://CVE-2026-87819_p1.patch \ file://CVE-2026-87819_p2.patch \ + file://CVE-2026-100689.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"