From patchwork Fri Oct 16 06:18:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101041 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F7D5CCA464 for ; Fri, 16 Oct 2026 06:19:35 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15899.1792131564223008482 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=aVnYgVbN; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6410; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=9M/Tn0T9bxSegSvsXUamxtRqwM15xmbkQPDZgPnVipA=; b=aVnYgVbN7aEzKZbJ4e8bT5cA6uJefqgESAFrgqsrVnB3XWcV74LGZasc j9vfHTH+CrjIQeT8TcMORyWhcitrjwDpyqjnS5DnJVJZtNIrV/Aw9INu+ BA7SCV3anZGWjeLBNrNxQoxZ09xfDZtEgI+13pzQESEmU4tFIMTAd8n5O Ms8uGbzNwhiudUqP/lzOXAlXOaEoJk6vTs7Cfkxjup8u7KEI0OY9U7rg1 +MPSlZ5Edlwrohs0a/dXCh+bimoEtFMc5AfcO5IsahGhbo4rQZJtFD9ag RXZu2Hg1W2GOtdfFRBCXk1KiY+0MppRYDjNxh0fcZrdOoQ8XgbCyycfYn Q==; X-CSE-ConnectionGUID: HcGEjmE7R1CouHm8u1tgZw== X-CSE-MsgGUID: 7gjcPKjWQy6Hvc/QBRsh8g== X-IPAS-Result: A0BJAgBrwNFq/5H/Ja1aH4I6gld1YENJlCmCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgmZDAT8CAkABUNhLEG+BaAELFAGBOIVAiCNdGAFEhDgnG4FJRIR+gQWBXAICGIENhn4EgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImTWEtASsXL4I0kmkBOI9kgiGBNZ9ahCiMIpU6GjOEBIFXkkCSVAuYfY4Klk+EaYFoPIFZMxoIGxWDIglKGQ+OKw4Lg2CFE1HIdicyAgkyAQEHAgcOAwuBaIRhix8CJgeBTwEB IronPort-Data: A9a23:MMU8u6o+osIT1/M+FSE5fHeeshZeBmJPZBIvgKrLsJaIsI4StFCzt garIBmCM/6PN2v1fdgiOo6080gAuJHSm9Q3HVA+/yg9Fywb+OPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0sZ8LkxM8 NFHEmkmaQ2jgrKrma60ePY506zPLOGzVG8ekmtrwTecCbMtRorOBv2ao9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVfrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUHJQOzhrJz o7A1zv2ABoiF96g8Cvb0mynwdblpzj7CI1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFm4HY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn288Vte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:ya+K66Gcgk5kyGkUpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:v3rMOGNopegZUu5DeCJI2UwRN58fK1ba0VfVc1LhFWlbV+jA X-Talos-MUID: 9a23:2wOLow4po1uePDes8PAFcUi5xow37KalMGMPrqwX5emaPmtJEQ2GjGS4F9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536193849" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 2C9911800047E for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id C7EA1CC12A7; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 01/27] python3-git: fix CVE-2026-67326 Date: Thu, 15 Oct 2026 23:18:56 -0700 Message-Id: <20261016061922.843414-2-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247970 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06 [2] https://www.cve.org/CVERecord?id=CVE-2026-67326 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67326.patch | 108 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 3 +- 2 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch new file mode 100644 index 0000000000..336460817a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch @@ -0,0 +1,108 @@ +From 8d534d0df8f00033c02e281291e39ed3b26f7690 Mon Sep 17 00:00:00 2001 +From: "GPT 5.5" +Date: Tue, 5 May 2026 21:34:42 +0800 +Subject: [PATCH 08/38] Validate config key section names before writing + +GitConfigParser already rejected CR, LF, and NUL in config values before +writing, but section and option names could still reach configparser. Because +GitPython writes section headers itself, a newline-bearing section name could +split the output into additional headers. + +Reject CR, LF, and NUL in section and option names on write paths that create +or set config keys: add_section(), set(), set_value(), add_value(), and +rename_section() destinations. This matches Git config key validation behavior; +Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys +containing newlines from config.c, and local git 2.50.1 rejects newline-bearing +config keys. + +Add a regression test covering unsafe section and option names while preserving +safe writes. + +CVE: CVE-2026-67326 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06] + +Backport Changes: +- Omit upstream regression test changes because the Scarthgap PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 54538428f79b0c91ba52cda5229856a6edf7ac06) +Signed-off-by: Yogita Urade +--- + git/config.py | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index 7988f5d9..1df1415f 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -71,6 +71,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr + See: https://git-scm.com/docs/git-config#_conditional_includes + """ + ++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ++"""Characters that cannot be safely written in config names or values.""" ++ + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 + """Utility class wrapping base-class methods into decorators that assure read-only properties.""" +@@ -741,6 +744,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def add_section(self, section: str) -> None: + """Assures added options will stay in order""" ++ self._assure_config_name_safe(section, "section") + return super().add_section(section) + + @property +@@ -843,10 +847,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + + def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: + value_str = self._value_to_string(value) +- if re.search(r"[\r\n\x00]", value_str): ++ if UNSAFE_CONFIG_CHARS_RE.search(value_str): + raise ValueError("Git config values must not contain CR, LF, or NUL") + return value_str + ++ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: ++ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): ++ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ + @needs_values + @set_dirty_and_flush_changes + def set( +@@ -855,6 +863,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + option: str, + value: Union[str, bytes, int, float, bool, None] = None, + ) -> None: ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + if value is not None: + value = self._value_to_string_safe(value) + return super().set(section, option, value) +@@ -873,6 +883,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + a string. + :return: This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -894,6 +906,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + to a string + :return: This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -909,6 +923,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + """ + if not self.has_section(section): + raise ValueError("Source section '%s' doesn't exist" % section) ++ self._assure_config_name_safe(new_name, "section") + if self.has_section(new_name): + raise ValueError("Destination section '%s' already exists" % new_name) + +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 38fbd8a078..1ba34dbf52 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -14,13 +14,14 @@ CVE_PRODUCT = "gitpython_project:gitpython" inherit pypi python_setuptools_build_meta -SRC_URI += "file://CVE-2026-42284.patch \ +SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-44243_p1.patch \ file://CVE-2026-44243_p2.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-42215_p1.patch \ file://CVE-2026-42215_p2.patch \ + file://CVE-2026-67326.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:18:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101048 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 863A0CCA462 for ; Fri, 16 Oct 2026 06:19:55 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15906.1792131584148701298 for ; Thu, 15 Oct 2026 23:19:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=djkLEyJa; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=14932; q=dns/txt; s=iport01; t=1792131585; x=1793341185; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=V5816T6aW3rfX++7+pcj7i3htQmF+dPCapLJZRwk4vs=; b=djkLEyJazoMKDmGJYSYeAEXOZyN7+tQdEJeDGI+cUJNaevAlyybRFf2p 4id9uDZe5iWnRntj11M7w05b78WaIYOGQOFYOrGpH8dB/sapmwrB3Av6q X3K23gzrCSmceRf9XwPpXZCn9nbtx/29lemzMKCyucD6VcQIDAgePyO67 ZwtBZDmb9v7sXNRCH89+oWvuaizmYpvGLIKhtHVKE2f9ypzNK5xq2z6WF 3NBpElFq9/0VtineWlYfx3zuWabXNnx00R9SOR7DU26m6FA4hgK4lYJSD a781iiDnsdiBJ+DYv6x2sfdVi0OwpL+L5VCZSdxEZiyclEQ9uarXRYniU g==; X-CSE-ConnectionGUID: rRRRiPhfTYqJ6GqVVeefxA== X-CSE-MsgGUID: CYXagMlxSWaM8/mUwS+uAQ== X-IPAS-Result: A0BLAgBfwdFq/5T/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8c4F5M4EBgykBPwICQAFQ2EsQb4FoAQsUAYE4hUCII10YAUSCVYFjJxuBSUSBFYNpgQWBMioCAhiBcoYZBIMcEoFagQOOSoV6SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGAgzEj0kLQErBB5ZCj4lEBw0MpJnAgGSPaEPhCiMIpU6GjOFW6UUC5h9jgqWT4RpgWg8gVkzGggbFTuCZwlKGQ+OKw4Lg2CFE1HIdicyAgYDMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:QDlGlaru0b4pFYPtKefXR+8kEx5eBmJPZBIvgKrLsJaIsI4StFCzt garIBnQO//YYmqkfNwnYN+xpk4GupCGy4JmTwtlrXo3FykapePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0vxNO1tPz fwWFAEUTE6sntyIzb+1WsA506zPLOGzVG8ekmtrwTecCbMtRorOBvyTo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LWPrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUGZUIwx3Bz o7A10/IMhgVEdiP8gWM1yLrg9LQpmDmcbtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2cHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn288lte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:xoGgQaOsqXrO+sBcTu2jsMiBIKoaSvp037BN7TEUdfU7SKKlfq yV8cjzkCWE6wr5O0tQ/OxoRpPgfZq0z/cciuMs1PWZLWvbUQCTQ72Kg7GP/9SZIU3D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:BbJXaGm257e4VpbCzkSB3G0j4zjXOWfn9k3RG0+2NVdwauO6UGGu9a5qg+M7zg== X-Talos-MUID: 9a23:KPna4ggmBNfpbclPZai57MMpH/ZY6quLDFA2rpwj646BCDNLeCq0tWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536485531" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 3269418000140 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id CD1ECCC12A8; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 02/27] python3-git: Fix CVE-2026-67323 Date: Thu, 15 Oct 2026 23:18:57 -0700 Message-Id: <20261016061922.843414-3-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247995 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738 [2] https://www.cve.org/CVERecord?id=CVE-2026-67323 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67323.patch | 346 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 347 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch new file mode 100644 index 0000000000..1d1140b65a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch @@ -0,0 +1,346 @@ +From be9e81b3ded21bb7e20d9d679cf3409002a7bc79 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 15:06:42 +0200 +Subject: [PATCH 11/38] fix: Guard unsafe git command options + (GHSA-956x-8gvw-wg5v) + +Reject command options that can execute arbitrary helpers or write files when passed through archive, revision traversal, blame, clone, fetch, pull, push, and ls-remote APIs. Validate positional option tokens and transformed keyword options consistently, including Git-supported long-option abbreviations, attached short-option values, and falsey stringifiable remotes. Preserve explicit allow_unsafe_options and allow_unsafe_protocols escape hatches. + +Add regression coverage for each guarded API, option spelling and abbreviation forms, inert keyword values, mixed positional and keyword candidates, tuple blame options, stringifiable remotes, and unsafe commands that must not create marker files. + +CVE: CVE-2026-67323 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. +- Port the guards into the 3.1.42 method signatures where + the upstream API had since changed. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 701ce32fe5ba8cb622c0e0342a376a6beb47d738) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 22 +++++++++++- + git/objects/commit.py | 12 ++++++ + git/remote.py | 15 ++++++-- + git/repo/base.py | 93 +++++++++++++++++++++++++++++++++++++++++++------ + 4 files changed, 126 insertions(+), 16 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 8e8cd0c5..81ea0b3c 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -316,6 +316,11 @@ class Git(LazyMixin): + + re_unsafe_protocol = re.compile(r"(.+)::.+") + ++ unsafe_git_ls_remote_options = [ ++ # This option allows arbitrary command execution in git-ls-remote. ++ "--upload-pack", ++ ] ++ + def __getstate__(self) -> Dict[str, Any]: + return slots_to_dict(self, exclude=self._excluded_) + +@@ -853,6 +858,21 @@ class Git(LazyMixin): + else: + super()._set_cache_(attr) + # END handle version info ++ def ls_remote( ++ self, ++ *args: Any, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]: ++ """List references in a remote repository. ++ ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--upload-pack``. ++ """ ++ if not allow_unsafe_options: ++ candidate_options = self._option_candidates(args, kwargs) ++ Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options) ++ return self._call_process("ls_remote", *args, **kwargs) + + @property + def working_dir(self) -> Union[None, PathLike]: +@@ -1295,7 +1315,7 @@ class Git(LazyMixin): + return args + + @classmethod +- def _unpack_args(cls, arg_list: Sequence[str]) -> List[str]: ++ def _unpack_args(cls, arg_list: Sequence[Any]) -> List[str]: + outlist = [] + if isinstance(arg_list, (list, tuple)): + for arg in arg_list: +diff --git a/git/objects/commit.py b/git/objects/commit.py +index caec1b6c..ae60d286 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -76,6 +76,12 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + default_encoding = "UTF-8" + + # object configuration ++ # Options to :manpage:`git-rev-list(1)` that can overwrite files. ++ unsafe_git_rev_options = [ ++ "--output", ++ "-o", ++ ] ++ + type: Literal["commit"] = "commit" + __slots__ = ( + "tree", +@@ -269,6 +275,7 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + repo: "Repo", + rev: Union[str, "Commit", "SymbolicReference"], # type: ignore + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator["Commit"]: + """Find all commits matching the given criteria. +@@ -294,6 +301,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + raise ValueError("--pretty cannot be used as parsing expects single sha's only") + # END handle pretty + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=cls.unsafe_git_rev_options ++ ) ++ + # Use -- in all cases, to prevent possibility of ambiguous arguments. + # See https://github.com/gitpython-developers/GitPython/issues/264. + +diff --git a/git/remote.py b/git/remote.py +index 3ccac59d..25e076f3 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -1005,7 +1005,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_fetch_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_fetch_options, ++ ) + + proc = self.repo.git.fetch( + "--", self, *args, as_process=True, with_stdout=False, universal_newlines=True, v=verbose, **kwargs +@@ -1046,7 +1049,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_pull_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_pull_options, ++ ) + + proc = self.repo.git.pull( + "--", self, refspec, with_stdout=False, as_process=True, universal_newlines=True, v=True, **kwargs +@@ -1111,7 +1117,10 @@ class Remote(LazyMixin, IterableObj): + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_push_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_push_options, ++ ) + + proc = self.repo.git.push( + "--", +diff --git a/git/repo/base.py b/git/repo/base.py +index 92ace3a0..5b255997 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -152,6 +152,20 @@ class Repo: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt + """ + ++ unsafe_git_archive_options = [ ++ # Allows arbitrary command execution through the remote git-upload-archive command. ++ "--exec", ++ # Writes output to a caller-controlled filesystem path. ++ "--output", ++ "-o", ++ ] ++ ++ unsafe_git_revision_options = [ ++ # This option allows output to be written to arbitrary files before revision parsing. ++ "--output", ++ "-o", ++ ] ++ + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") + """Represents the configuration level of a configuration file.""" +@@ -690,6 +704,7 @@ class Repo: + self, + rev: Union[str, Commit, "SymbolicReference", None] = None, + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator[Commit]: + """A list of Commit objects representing the history of a given ref/commit. +@@ -705,7 +720,11 @@ class Repo: + :param kwargs: + Arguments to be passed to git-rev-list - common ones are max_count and skip. + +- :note: To receive only commits between two named revisions, use the ++ :param allow_unsafe_options: ++ Allow unsafe options in the revision argument, like ``--output``. ++ ++ :note: ++ To receive only commits between two named revisions, use the + ``"revA...revB"`` revision specifier. + + :return: ``git.Commit[]`` +@@ -713,7 +732,18 @@ class Repo: + if rev is None: + rev = self.head.commit + +- return Commit.iter_items(self, rev, paths, **kwargs) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) ++ ++ return Commit.iter_items( ++ self, ++ rev, ++ paths, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + + def merge_base(self, *rev: TBD, **kwargs: Any) -> List[Union[Commit_ish, None]]: + """Find the closest common ancestor for the given revision (Commits, Tags, References, etc.). +@@ -957,7 +987,9 @@ class Repo: + # reveal_type(self.head.reference) # => Reference + return self.head.reference + +- def blame_incremental(self, rev: str | HEAD, file: str, **kwargs: Any) -> Iterator["BlameEntry"]: ++ def blame_incremental( ++ self, rev: str | HEAD | None, file: str, allow_unsafe_options: bool = False, **kwargs: Any ++ ) -> Iterator["BlameEntry"]: + """Iterator for blame information for the given file at the given revision. + + Unlike :meth:`blame`, this does not return the actual file's contents, only a +@@ -965,13 +997,21 @@ class Repo: + + :param rev: Revision specifier, see git-rev-parse for viable options. + +- :return: Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates +- the commit to blame for the line, and range indicates a span of line numbers +- in the resulting file. ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ ++ :return: ++ Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the ++ commit to blame for the line, and range indicates a span of line numbers in ++ the resulting file. + + If you combine all line number ranges outputted by this command, you should get + a continuous range spanning all line numbers in the file. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) + + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) + commits: Dict[bytes, Commit] = {} +@@ -1048,13 +1088,17 @@ class Repo: + rev: Union[str, HEAD], + file: str, + incremental: bool = False, +- rev_opts: Optional[List[str]] = None, ++ rev_opts: Optional[Sequence[str]] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[List[Commit | List[str | bytes] | None]] | Iterator[BlameEntry] | None: + """The blame information for the given file at the given revision. + + :param rev: Revision specifier, see git-rev-parse for viable options. + ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ + :return: + list: [git.Commit, list: []] + +@@ -1063,9 +1107,14 @@ class Repo: + of appearance. + """ + if incremental: +- return self.blame_incremental(rev, file, **kwargs) +- rev_opts = rev_opts or [] +- data: bytes = self.git.blame(rev, *rev_opts, "--", file, p=True, stdout_as_string=False, **kwargs) ++ return self.blame_incremental(rev, file, allow_unsafe_options=allow_unsafe_options, **kwargs) ++ rev_opts_list = list(rev_opts or []) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev, rev_opts_list], kwargs), ++ unsafe_options=self.unsafe_git_revision_options, ++ ) ++ data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} + blames: List[List[Commit | List[str | bytes] | None]] = [] + +@@ -1270,7 +1319,10 @@ class Repo: + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(str(url)) + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=cls.unsafe_git_clone_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_clone_options, ++ ) + if not allow_unsafe_options and multi: + Git.check_unsafe_options(options=multi, unsafe_options=cls.unsafe_git_clone_options) + +@@ -1419,6 +1471,8 @@ class Repo: + ostream: Union[TextIO, BinaryIO], + treeish: Optional[str] = None, + prefix: Optional[str] = None, ++ allow_unsafe_options: bool = False, ++ allow_unsafe_protocols: bool = False, + **kwargs: Any, + ) -> Repo: + """Archive the tree at the given revision. +@@ -1436,7 +1490,14 @@ class Repo: + * You may specify the special **path** keyword, which may either be a repository-relative + path to a directory or file to place into the archive, or a list or tuple of multiple paths. + +- :raise GitCommandError: If something went wrong. ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--exec`` or ``--output``. ++ ++ :param allow_unsafe_protocols: ++ Allow unsafe protocols to be used in ``remote``, like ``ext``. ++ ++ :raise git.exc.GitCommandError: ++ If something went wrong. + + :return: self + """ +@@ -1444,6 +1505,14 @@ class Repo: + treeish = self.head.commit + if prefix and "prefix" not in kwargs: + kwargs["prefix"] = prefix ++ remote = kwargs.get("remote") ++ if not allow_unsafe_protocols and remote is not None: ++ Git.check_unsafe_protocols(str(remote)) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_archive_options, ++ ) + kwargs["output_stream"] = ostream + path = kwargs.pop("path", []) + path = cast(Union[PathLike, List[PathLike], Tuple[PathLike, ...]], path) +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 1ba34dbf52..f3d2c9de80 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -22,6 +22,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-42215_p1.patch \ file://CVE-2026-42215_p2.patch \ file://CVE-2026-67326.patch \ + file://CVE-2026-67323.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:18:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101043 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57A54CCF2CE for ; Fri, 16 Oct 2026 06:19:35 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15610.1792131564069746027 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NRoNSpbH; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6743; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ZQqPNM+qr7Dvl1ExF5CDWnYPWgMromlqKcavUZVsUTE=; b=NRoNSpbHbgVipb93S+Ei0asnJqe8y5Jhbuk64gV1hFO71q7gbtlklY5n ZxvwRm2coqFBOKRy3peT0KTcWvsaca1Ayw1RHc3u/pGjiYIodsX5IjB78 2bETZ3nf/OkhHQL7fEt61Mpr3gqtswqmR515O9hmKv4yobgot8ET2QfjZ OgSoSNPizTN5h61f8pqKypnm3l4Pd89nKKks8x1/Z6tJNJjgNuU2GYpxz IX24xGcBO58MU16YCXFDVNBo4/hPUs3v78A9ACNhhEFIRNF7/3kAgKW1R muFsTA2md5j5LgswfZ79e1qYrzLSze7CG8mBtcX0R8yY2ZxwnGUA9Yipj A==; X-CSE-ConnectionGUID: 13uANjqvTvy6vacVEHBIYA== X-CSE-MsgGUID: cfsqRvs9SQOWMCh37CUf5g== X-IPAS-Result: A0BcAgDpwNFq/4v/Ja1aHgEBCxIMggULgld1YENJA5QmgiEDi2WSN4F+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBPRwDAQIvIAsjCBmDAgGCOgM3AxG8doIsgQGDKQE/AkNQ2EsNA2+BaAELFAGBOIVAgn+FJF0YAYR8JxuBSUSEfoEFgRpCAgIYgQ2GfgSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BcyVNASwQUQEKIYFNCD6UCY9kgiGBNZ5pcYQojCKPPoV8GjOqbwuYfY4KhAmRMS1ohGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICBgMyAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:INwY2qo1+BNAFqqgp7sI7U9nVDNeBmJPZBIvgKrLsJaIsI4StFCzt garIBmOa/7bNDD1KIojOtu29BgO7J7VzYU3QQtp+yswFn8S9ePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0r8sHEho9 +UGFC4cMA6KjNyb4Jiae8A506zPLOGzVG8ekmtrwTecCbMtRorOBv2Qo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5MWfrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUGp8PwRzIz o7A12/3GQggKsfO8gOizVeHhrSQth71BY1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmQHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn288Vte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:eKl0wKiUNP+BuBB+09ohmo6xunBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:WvHmS21LbUKfzBqWbUWc6rxfQ5s4W1vf1WnsPV7mF29idpC1Y36h0fYx X-Talos-MUID: 9a23:4McxaAZW4dnHZeBTvDH3nQt8L5ZT2oORLWsNysothsfZOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722728" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 383B01800022B for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id D2033CC12A9; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 03/27] python3-git: fix CVE-2026-67325 Date: Thu, 15 Oct 2026 23:18:58 -0700 Message-Id: <20261016061922.843414-4-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247971 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f [2] https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63 [3] https://www.cve.org/CVERecord?id=CVE-2026-67325 Signed-off-by: Yogita Urade --- .../python3-git/CVE-2026-67325_p1.patch | 50 +++++++++++++++++ .../python3-git/CVE-2026-67325_p2.patch | 53 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 2 + 3 files changed, 105 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch new file mode 100644 index 0000000000..7c49ff0543 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch @@ -0,0 +1,50 @@ +From 2375813d552210675950e73cbdad1baec3be8d74 Mon Sep 17 00:00:00 2001 +From: abhiprd2000 <8292aniarc@gmail.com> +Date: Thu, 9 Jul 2026 21:22:50 +0530 +Subject: [PATCH 09/38] Reject abbreviated forms of unsafe git options + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +(cherry picked from commit 2ab051697940144545a14d2f4a639c6409c3187f) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index c09d47ba..e965c586 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -563,13 +563,20 @@ class Git(LazyMixin): + arbitrary commands, this are blocked by default. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. ++ # Git accepts any unambiguous prefix of a long option, so an abbreviated ++ # spelling such as `--upl` for `--upload-pack` must be rejected too. An ++ # option is unsafe if its canonical name is a prefix of any blocked ++ # option's canonical name. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} + for option in options: +- unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option)) +- if unsafe_option is not None: +- raise UnsafeOptionError( +- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." +- ) ++ candidate = cls._canonicalize_option_name(option) ++ if not candidate: ++ continue ++ for canonical, unsafe_option in canonical_unsafe_options.items(): ++ if canonical.startswith(candidate): ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) + + class AutoInterrupt: + """Process wrapper that terminates the wrapped process on finalization. +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch new file mode 100644 index 0000000000..6fcbb20d48 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch @@ -0,0 +1,53 @@ +From de30c364114907e1cb240ea8ce0e7aadd9ef32b2 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 13:45:42 +0200 +Subject: [PATCH 10/38] Address review feedback about unsafe option + abbreviations + +The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs. + +This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected. + +Reviewd-by: Sebastian Thiel + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +(cherry picked from commit 181e8ede7543dbbdcee92756cea260f675316c63) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index e965c586..8e8cd0c5 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -566,12 +566,20 @@ class Git(LazyMixin): + # Git accepts any unambiguous prefix of a long option, so an abbreviated + # spelling such as `--upl` for `--upload-pack` must be rejected too. An + # option is unsafe if its canonical name is a prefix of any blocked +- # option's canonical name. ++ # option's canonical name. Only long options and multi-character kwargs ++ # can be abbreviations; single-character short options remain exact-match ++ # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) + if not candidate: + continue ++ unsafe_option = canonical_unsafe_options.get(candidate) ++ if unsafe_option is not None: ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): ++ continue + for canonical, unsafe_option in canonical_unsafe_options.items(): + if canonical.startswith(candidate): + raise UnsafeOptionError( +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index f3d2c9de80..a36a0faa29 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -23,6 +23,8 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-42215_p2.patch \ file://CVE-2026-67326.patch \ file://CVE-2026-67323.patch \ + file://CVE-2026-67325_p1.patch \ + file://CVE-2026-67325_p2.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:18:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101038 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAB5CCCF2CC for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15611.1792131564294051812 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ZoFy4xi5; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6405; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=zSBgtQiFWRg2SgH/ya3FElF+kJrlmWtrZa887SNkCiY=; b=ZoFy4xi5r7nzisvInAMgNwptvHsXn55ys/SOiy2AqiCqycd+kRTNeK5o UWNlRBInk6yf16Vigow8OXaO0LtkpXQ38v8s/OFUz+C6Bsc5JT4rYVeCp FwC891kF41HFTfZ9LS93R/sqBAW/jqyJot8iKlsrIkPFOfe57HEQVE/cW MgA0pvATyw9dg63D0npjIiD2D62KXCEpnDIRxd45TcErMtentY2nmFMr2 KCGhtCOZOgPq8E7DW+VDuBMS2eOCwJ5xjXxeBIH54PjufzJV8cE8MOhtm PCbjuinfKVPp3Py7MmZLgx3LDnR584aRyJqBmk+q5voeT2oHA6OM2F+hD g==; X-CSE-ConnectionGUID: uI0PVcpURYajZ6eXb8M02w== X-CSE-MsgGUID: nM1rxIj7Sj+K+ZcptH3S9A== X-IPAS-Result: A0BLAgDpwNFq/4r/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEhDgnG4FJRIEVg2mBBYFcAgIYiAsEgxwSgVqBA45KhXpIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYCDMSASwQUQEKIYIUpg2fUYE+hCiMIpU6GjOqbwuYfY4KlTqBFYRpgWg8gVkzGggbFTuCZwlKGQ+OOYNrhRNRyHYnMgIGAzIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:H0xozq5YvPUHx62Oecg4nAxRtG/GchMFZxGqfqrLsTDasY5as4F+v mpLUWnTPf/cYGXze4t1b4y/px4O65HUydBnQARv/3szZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eIKxAwth8GVx0x PUaGm4AXhrTorrs3+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGcmFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkYfUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwaoCNI4PTHpo9ckCwo Eef5XTYAE4hNp+8igiO6m6M3dSetHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rAnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:ciot8KwSbwZhKZxSN0vuKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:Il6diGnybs+vT0IsiLpDj9aJqALXOWD8lE/uKFeFM1dgSo/LRG+aqIY8ydU7zg== X-Talos-MUID: 9a23:+EFmYwuu1jYThmvnh82nghQ7LtdJ4fuVCgMu0qcNo9WkbhchEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522017137" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 3C6D21800028F for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id D762ACC124A; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 04/27] python3-git: fix CVE-2026-67324 Date: Thu, 15 Oct 2026 23:18:59 -0700 Message-Id: <20261016061922.843414-5-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247969 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285 [2] https://www.cve.org/CVERecord?id=CVE-2026-67324 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67324.patch | 102 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch new file mode 100644 index 0000000000..a780464905 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch @@ -0,0 +1,102 @@ +From a5742dea36a84dece8a01526cdef0714aecac070 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 14:12:16 +0200 +Subject: [PATCH 12/38] fix: reject joined unsafe short options + +GitPython blocks options such as --upload-pack/-u and --config/-c +because they can execute arbitrary commands unless unsafe options are +explicitly allowed. Git also accepts a short option with its value +joined to the same token, including after clusterable flags. Forms +such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore +bypass an exact-token check. + +Parse single-dash option tokens sufficiently to recognize blocked +short options while preserving safe attached values such as +-oupstream. Also distinguish clone multi-option values from bare +kwargs so positional values are not treated as long-option +abbreviations. + +This completes the option-validation hardening for +GHSA-2f96-g7mh-g2hx. + +CVE: CVE-2026-67324 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 56806080c1348749b07daa4a2024ce47b3cad285) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 40 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 81ea0b3c..1903bb01 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -562,10 +562,23 @@ class Git(LazyMixin): + + @classmethod + def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: +- """Check for unsafe options. +- +- Some options that are passed to `git ` can be used to execute +- arbitrary commands, this are blocked by default. ++ """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. ++ ++ In addition to exact matches, this rejects abbreviated long options accepted ++ by Git (for example, ``--upl`` for ``--upload-pack``) and unsafe short options ++ whose values are joined to the same token, including after clusterable flags ++ (for example, ``-uVALUE`` and ``-fuVALUE``). ++ ++ A list containing only bare names is treated as normalized keyword arguments, ++ so multi-character names such as ``upload_p`` are checked as long-option ++ abbreviations. If any item starts with ``-``, the list is treated as tokenized ++ command-line input: bare items can be option values and are not checked as ++ abbreviations. Thus ``["--origin", "upload"]`` is allowed. Single-dash options ++ use short-option parsing rather than broad prefix matching, preserving safe ++ attached values such as ``-oupstream`` and ``-bcurrent``. ++ ++ Some options passed to ``git `` can execute arbitrary commands and ++ are therefore blocked by default unless the caller explicitly allows them. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. + # Git accepts any unambiguous prefix of a long option, so an abbreviated +@@ -575,6 +588,15 @@ class Git(LazyMixin): + # can be abbreviations; single-character short options remain exact-match + # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ unsafe_short_options = { ++ canonical: option ++ for canonical, option in canonical_unsafe_options.items() ++ if option.startswith("-") and not option.startswith("--") and len(canonical) == 1 ++ } ++ # These value-less Git flags can be clustered before another short option ++ # (for example, ``-fuVALUE``). Stop at any other character because it may ++ # begin an attached value, as ``o`` does in the safe option ``-oupstream``. ++ clusterable_short_options = frozenset("46flnqsv") + options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) +@@ -583,6 +605,16 @@ class Git(LazyMixin): + unsafe_option = canonical_unsafe_options.get(candidate) + if unsafe_option is not None: + raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ option_token = option.split("=", 1)[0].split(None, 1)[0] ++ if option_token.startswith("-") and not option_token.startswith("--"): ++ for option_char in option_token[1:]: ++ unsafe_option = unsafe_short_options.get(option_char) ++ if unsafe_option is not None: ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) ++ if option_char not in clusterable_short_options: ++ break + if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): + continue + for canonical, unsafe_option in canonical_unsafe_options.items(): +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index a36a0faa29..788cc4c173 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -25,6 +25,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-67323.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ + file://CVE-2026-67324.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101040 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE10ACCF2CB for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15611.1792131564294051812 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=DYgyO+c1; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8022; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=SWha3Ok9Scp9z+SZDlKzbLbQ1iSIUs4pqrDW8rwmiCE=; b=DYgyO+c16/dtZ9l2A91cfvfVDa7sDCYLYKT4hwchT45m37yMKntQClD+ 291HDNT8sLDmjYqodDl0IbPMk7DoG/7P0ZJ0mWq6fEkIuDLUhR47uuRUI ouvlq/RELbNH5c3mJFySOnQcC8RdLukWK07GNk714z3XScSwNps/cbejf CeRQB1NxNAfwTDIiu1gCJ/q7+yB7rsLc+lbOd5dl0WkC/FXw2KYwu0SrV 8F2YlvR0zUgQbbroDEXi1TGwgBkc4JBaCuQQ8ViZrfctj3pcZXvjzm7Yh 6qW3AGxVdXTka2YKaPVfjB06gmHJ5LHR/GAp2MR/4g2uqR04se9tShCjC A==; X-CSE-ConnectionGUID: JLnIVub/Q+ef1KisAbThfQ== X-CSE-MsgGUID: XExyuF1sTImMzO4FAWYp3w== X-IPAS-Result: A0BMAgDpwNFq/4z/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOTHop+gX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKx0BBQgZgwIBgjoDNwMRvHaBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIQ4JxuBSUSBFYNpgQWBXAICGIgLBIMcEoFagQOUREiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghg7Ej0cGwcEDwErgTQPCgQsL5M1CpI2oQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBWTMaCBsVO4JnCUoZD445g2uFE1FsyAonMgIGAzIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:H54oDa3IjIFte6JElfbD5YRwkn2cJEfYwER7XKvMYLTBsI5bp2QOz GBLDD+GaP2PNGOje9skYY6y9EsFuJLUm4NlTANo3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGLmUwHLMF8KFOQmxAr N8ZMxkHUhCNvrfjqF67YrEEasULNsLnOsYb/3pn1zycVa1gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUiYC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsiuK1aYWMJofiqcN9rmuIt 3/opn/FIxQ/JvvD5xO6w2r3mbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXJIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:fQGXOaOmpXGF4sBcTu2jsMiBIKoaSvp037BN7TEUdfU7SKKlfq yV8cjzkCWE6wr5O0tQ/OxoRpPgfZq0z/cciuMs1PWZLWvbUQCTQ72Kg7GP/9SZIU3D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:Kkp4f2Ov/ZKZRe5Deg1h1XAJEIccMXDTlVTROGayNWZncejA X-Talos-MUID: 9a23:qGa3mglUeHkod58SYkMvdnpSGdd5/or3E3wslLAUnJWqHBNBI2yC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522017143" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 853EE180001CD for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id DCCB1CC124B; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 05/27] python3-git: fix CVE-2026-67322 Date: Thu, 15 Oct 2026 23:19:00 -0700 Message-Id: <20261016061922.843414-6-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247976 This patch applies the upstream fix as referenced in [2], using the commit shown in [1] [1] https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2 [2] https://www.cve.org/CVERecord?id=CVE-2026-67322 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-67322.patch | 174 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 175 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch new file mode 100644 index 0000000000..1c378c9e77 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch @@ -0,0 +1,174 @@ +From eca51fe4d3741f64b4204a6da04536d428390a4f Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 15 Jul 2026 16:44:13 +0200 +Subject: [PATCH 13/38] fix: prevent environment expansion in clone URLs + +Repo.clone_from() expanded environment-variable references in caller-supplied +URLs before passing them to git clone. This could expose process environment +values to an untrusted remote and made protocol validation apply to a different +value than Git received. + +Polish clone URLs without variable or home expansion on native and Cygwin +Git, then apply unsafe-protocol validation to that exact normalized value. +Preserve the literal URL when normalizing the stored origin after a successful +clone, while retaining the existing Git.polish_url() default for callers +that intentionally normalize local paths. Add regression coverage for +POSIX and Windows variable syntax, Cygwin conversion, stored origins, and +post-normalization protocol validation. + +Git baseline: git clone passes URL arguments through literally; t/t5601-clone.sh +covers the accepted URL forms without shell-style environment expansion. + +Security: GHSA-rwj8-pgh3-r573. + +CVE: CVE-2026-67322 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 8ac5a30519b6f4af85398b9b9d7064ff4d452da2) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 29 ++++++++++++++++------------- + git/repo/base.py | 7 ++++--- + git/util.py | 15 +++++++++------ + 3 files changed, 29 insertions(+), 22 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 1903bb01..46619459 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -497,31 +497,34 @@ class Git(LazyMixin): + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Literal[False] = ...) -> str: +- ... ++ def polish_url(cls, url: str, is_cygwin: Literal[False] = ..., expand_vars: bool = ...) -> str: ... + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> str: +- ... ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> str: ... + + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> PathLike: +- """Remove any backslashes from urls to be written in config files. ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> PathLike: ++ """Remove any backslashes from URLs to be written in config files. ++ ++ Windows might create config files containing paths with backslashes, but git ++ stops liking them as it will escape the backslashes. Hence we undo the escaping ++ just to be sure. + +- Windows might create config files containing paths with backslashes, +- but git stops liking them as it will escape the backslashes. Hence we +- undo the escaping just to be sure. ++ :param expand_vars: ++ Expand environment variables and an initial ``~``. Disable this for values ++ obtained from an untrusted source, such as remote URLs. + """ + if is_cygwin is None: + is_cygwin = cls.is_cygwin() + + if is_cygwin: +- url = cygpath(url) ++ url = cygpath(url, expand_vars=expand_vars) + else: +- url = os.path.expandvars(url) +- if url.startswith("~"): +- url = os.path.expanduser(url) ++ if expand_vars: ++ url = os.path.expandvars(url) ++ if url.startswith("~"): ++ url = os.path.expanduser(url) + url = url.replace("\\\\", "\\").replace("\\", "/") + return url + +diff --git a/git/repo/base.py b/git/repo/base.py +index 5b255997..0440a92d 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -1316,8 +1316,9 @@ class Repo: + if multi_options: + multi = shlex.split(" ".join(multi_options)) + ++ clone_url = Git.polish_url(url, expand_vars=False) + if not allow_unsafe_protocols: +- Git.check_unsafe_protocols(str(url)) ++ Git.check_unsafe_protocols(clone_url) + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([], kwargs), +@@ -1329,7 +1330,7 @@ class Repo: + proc = git.clone( + multi, + "--", +- Git.polish_url(str(url)), ++ clone_url, + clone_path, + with_extended_output=True, + as_process=True, +@@ -1370,7 +1371,7 @@ class Repo: + # sure. + if repo.remotes: + with repo.remotes[0].config_writer as writer: +- writer.set_value("url", Git.polish_url(repo.remotes[0].url)) ++ writer.set_value("url", Git.polish_url(repo.remotes[0].url, expand_vars=False)) + # END handle remote repo + return repo + +diff --git a/git/util.py b/git/util.py +index 5a136d18..d3eaeb8b 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -361,13 +361,13 @@ def py_where(program: str, path: Optional[PathLike] = None) -> List[str]: + return progs + + +-def _cygexpath(drive: Optional[str], path: str) -> str: ++def _cygexpath(drive: Optional[str], path: str, expand_vars: bool = True) -> str: + if osp.isabs(path) and not drive: + # Invoked from `cygpath()` directly with `D:Apps\123`? + # It's an error, leave it alone just slashes) + p = path # convert to str if AnyPath given + else: +- p = path and osp.normpath(osp.expandvars(osp.expanduser(path))) ++ p = path and osp.normpath(osp.expandvars(osp.expanduser(path)) if expand_vars else path) + if osp.isabs(p): + if drive: + # Confusing, maybe a remote system should expand vars. +@@ -395,7 +395,7 @@ _cygpath_parsers: Tuple[Tuple[Pattern[str], Callable, bool], ...] = ( + ) + + +-def cygpath(path: str) -> str: ++def cygpath(path: str, expand_vars: bool = True) -> str: + """Use :meth:`git.cmd.Git.polish_url` instead, that works on any environment.""" + path = str(path) # Ensure is str and not AnyPath. + # Fix to use Paths when 3.5 dropped. Or to be just str if only for URLs? +@@ -403,12 +403,15 @@ def cygpath(path: str) -> str: + for regex, parser, recurse in _cygpath_parsers: + match = regex.match(path) + if match: +- path = parser(*match.groups()) ++ if parser is _cygexpath: ++ path = parser(*match.groups(), expand_vars=expand_vars) ++ else: ++ path = parser(*match.groups()) + if recurse: +- path = cygpath(path) ++ path = cygpath(path, expand_vars=expand_vars) + break + else: +- path = _cygexpath(None, path) ++ path = _cygexpath(None, path, expand_vars=expand_vars) + + return path + +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 788cc4c173..cbfdb5e757 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -26,6 +26,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ + file://CVE-2026-67322.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101035 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4E2FCCF2C8 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15610.1792131564069746027 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=PxAamFAi; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4124; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=lxy8VCrHQYzFxr7ExFQ+R7gOFgTgTNkQE16utKmPmVU=; b=PxAamFAi7+77CMQ+chitS42z1SaOy2GZfKeniCApYsISUgUw+1RjL5PL PFTlaySNGDlGuf9WcK0pm70lpcAkmEs5NF9qqbv1UpJdrnQEe5UwOSD89 9G8iP4+Cmoa2owFI2EJmKQFQ/Ysg05XIWSfH2/o4AnW9PxPnbpRkWT5Ls Gca/LyS0UEOz8/eUjiP2R8aI3hdRauSLjlKqFH0hnzMW4ETxBYMat9K+o X13GZV2v16h9gBdSxUOsqQ9ei5bTj+z2m2nASsv0GIOUTGEWbMXh2tLij xGBocXGWkfZE7WViZE+Bvffp5IXjxTwK+rxVApjOtQ439uZ+dxiqAshnX g==; X-CSE-ConnectionGUID: CbcDELaFT1a/5CpZso6gtA== X-CSE-MsgGUID: RApqbDGjTuqaJqYPTm9Hcw== X-IPAS-Result: A0BIAgDpwNFq/5D/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIgLBIMcEoFaGJUvSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGE09UQEKIUaBGiVJkxWQHYIhoQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:/OZQh66UmOHLZivuWgrhSwxRtG/GchMFZxGqfqrLsTDasY5as4F+v mUeX2vVPfvbZ2ajeIx+bI21oRkH7cOEzYRhTQFppH0yZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eFocT1stTCE9yr PVfdRsVXAuE2e2q6efuIgVsrpxLwMjDJogTvDRkiDreF/tjGc+FSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkETUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4SKIIbVHp89ckCwn Eve5m7VLRMmKcWW6yO0yk6p18/EgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWS4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rBnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:S5IEG6hAWXj+LmvhLd5DptYSV3BQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:d5aZS2ONLxA4cu5DcyNs2GMwE+4ZK3SakVzIEVS/V2l1YejA X-Talos-MUID: 9a23:z234WAhyWNy2QFmrd1lQqcMpDu5w+q6CJ0IxjIwPmdC1DRB1aheWk2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722732" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 8841D180003C5 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id E1D43CC124C; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 06/27] python3-git: fix CVE-2026-69097 Date: Thu, 15 Oct 2026 23:19:01 -0700 Message-Id: <20261016061922.843414-7-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247975 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1 [2] https://www.cve.org/CVERecord?id=CVE-2026-69097 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-69097.patch | 61 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch new file mode 100644 index 0000000000..9d472d3358 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch @@ -0,0 +1,61 @@ +From 128f8da8dac072f61427b5bf7801173915d69b85 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Mon, 20 Jul 2026 14:13:22 +0200 +Subject: [PATCH 14/38] fix: validate config section delimiters + +GHSA-3rp5-jjmw-4wv2 identified that configuration section names could alter the +structure of serialized config despite the existing control-character checks. + +Reject unquoted closing section delimiters across all writer entry points +while preserving valid delimiters inside quoted subsections and the +existing option-name behavior. Add regression coverage for unsafe plain and +quoted-subsection-shaped names as well as a valid quoted subsection. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. Git config parsing +treats an unquoted closing bracket as the end of a basic section header, while +its extended form permits brackets inside a quoted subsection and requires a +final bracket after the closing quote. + +CVE: CVE-2026-69097 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f1) +Signed-off-by: Yogita Urade +--- + git/config.py | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/git/config.py b/git/config.py +index 1df1415f..3015bb73 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -854,6 +854,22 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "section" and isinstance(name, str): ++ in_quotes = False ++ escaped = False ++ for index, char in enumerate(name): ++ if escaped: ++ escaped = False ++ elif in_quotes and char == "\\": ++ escaped = True ++ elif char == '"': ++ if not in_quotes and (index == 0 or name[index - 1] not in " \t"): ++ raise ValueError("Git config quoted subsection names must begin after whitespace") ++ in_quotes = not in_quotes ++ elif char == "]" and not in_quotes: ++ raise ValueError("Git config section names must not contain an unquoted closing bracket") ++ if in_quotes: ++ raise ValueError("Git config section names must not contain an unterminated quote") + + @needs_values + @set_dirty_and_flush_changes +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index cbfdb5e757..c5cefeaee8 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -27,6 +27,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ + file://CVE-2026-69097.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101024 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AD82CCA48F for ; Fri, 16 Oct 2026 06:19:32 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15612.1792131564472441473 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=MfvtAeyR; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4161; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=eqd09agjIaLh/DSuHrNS6YZBGfk4BR2S5w53nznAwIw=; b=MfvtAeyRhel1g5HR1mx9JwJxyH0GKHzkmEbzaYzf+k8NLXp/7/PBKm2j dAHlzE1XHA2rUDe6Emm6vlDmIRuHGP0+l7khPZcuZwglN4qHdL+4z39YL gEIS1VC0A7FcdcW45N8sF/32Kf/SZLsg7RXKvOXfRltdf4iEIC16vBoxe HO4hxwPoeVxEuoJMihEMhGylsb9FdTv/GqiuI1rRig6o3Wp8ruy88x0T8 WsaU6Yq+WVyc4Gmpenj6KQX+tx7o6nZMSYrywr72wsVMmBJ78ggSJXNXI cKrxzdp1cya47gSt3HT6IT9STCJY8ErY8PyxjncxyM5FmYaX8MWjg4U2E w==; X-CSE-ConnectionGUID: TqRlqjM5QA2B0I4f6z0Meg== X-CSE-MsgGUID: cuPJELK8RW2t6daSRzfawQ== X-IPAS-Result: A0BLAgBrwNFq/4z/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEhDgnG4FJRIEVg2mBBYFcAgIYiAsEgg2BDxKBWoEDhAuQOUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhNPVEBK4FNbqNFgiGhD4QojCKVOhozqm8LmH2OCpZPhGmBaDyBWTMaCBsVO4JnCUoZD445g2uFE1HIdicyAgYDMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:gvePWa227E63M1gnOPbD5YRwkn2cJEfYwER7XKvMYLTBsI5bpzQPy TZLUW+FM/7cMWb0e49wbIzkpEMHuJKBytY2SQI53Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGMFgMOZQa37tOKDtkr d1EJm4fNjWOiLfjqF67YrEEasULNsLnOsYb/3pn1zycVa1gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUiYC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsi+W2a4aMKoDiqcN9lVugh E/i3DTDPUsGatCW8gCX/Huzv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXJIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:F4/uEquYlyIPn7et2HnzevS87skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:nMiHcm3uIEjg9XUn7LuDfbxfJtkfdmTf6SrpChWSUUc1RuOHEXqd9/Yx X-Talos-MUID: 9a23:tavqTAmIZkGxoGM5DRgMdnppKf9KzoCNWHoyy4lYt8C/Dz5+Miik2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535334184" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 8D97618000618 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id E7762CC124D; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 07/27] python3-git: fix CVE-2026-73625 Date: Thu, 15 Oct 2026 23:19:02 -0700 Message-Id: <20261016061922.843414-8-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247972 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453 [2] https://www.cve.org/CVERecord?id=CVE-2026-73625 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73625.patch | 68 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch new file mode 100644 index 0000000000..995c7cbaa0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch @@ -0,0 +1,68 @@ +From ac1290549f1f8fa8ba19370805200f69b52a56db Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:39:00 +0200 +Subject: [PATCH 15/38] fix: validate split short-option values + + + +Single-character keyword arguments are transformed into an option token and +a separate value token. The unsafe-option candidate builder only checked the +keyword name, allowing an option-like value to bypass guards shared by clone, +remote, revision, blame, and archive operations. + +Include dash-prefixed values only when short options are actually split, +including sequence values, while preserving bare values and the non-splitting +compatibility path. + +Git baseline a23bace9 defines clone -n and --upload-pack as distinct options, +matching the argv boundary this validation now preserves. + +Refs GHSA-r9mr-m37c-5fr3. + +CVE: CVE-2026-73625 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit e8d0fbf774d1f6baa3b481adfe48bd262e43b453) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/git/cmd.py b/git/cmd.py +index 46619459..f907fa4e 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -626,6 +626,26 @@ class Git(LazyMixin): + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) + ++ @classmethod ++ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]: ++ """Collect possible option spellings before command-line transformation.""" ++ options = [ ++ option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-") ++ ] ++ if kwargs: ++ split_single_char_options = kwargs.get("split_single_char_options", True) ++ for key, value in kwargs.items(): ++ values = value if isinstance(value, (list, tuple)) else (value,) ++ if any(value is True or (value is not False and value is not None) for value in values): ++ key = str(key) ++ options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") ++ if len(key) == 1 and split_single_char_options: ++ options.extend( ++ str(value) ++ for value in values ++ if value is not True and value not in (False, None) and str(value).startswith("-") ++ ) ++ return options + class AutoInterrupt: + """Process wrapper that terminates the wrapped process on finalization. + +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index c5cefeaee8..18132b8af9 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -28,6 +28,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ + file://CVE-2026-73625.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101039 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F3CCCCA462 for ; Fri, 16 Oct 2026 06:19:35 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15610.1792131564069746027 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=QViBk5ya; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3404; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=qW9373qpKUB35qvYSl/EgXxzTTZwjon0uZ2DLKYYuhk=; b=QViBk5yaJVVCZcoWl8r/Nqi5SLlSSAzlHC08TovyYYhE4L+EeFvBedzt 0wWJXuUUtloMAAJLJS6wPZM75UydVCcTWyclGOgqGXSHUiycz4mk5rcei wOmW8f3AK3ZTGt0jjzIkGwOZUJlaPFxiXwUAfT9OcmFkHjtYpD7C1BoW2 fvq2KBUiYv0RGAPQXsS56Iku3Yydo6iGW6gS66R20qf0e1d1TcHYx+5rA HCUXoY12hrlaHsV3Ya4Vh7msNDh4BOMGAtZ1aEJIeXtiZhG+4zjjUeCL8 g0rFAg4e692XQw/AnRUGr5Ue5Hnj8tLIMsxeUbhp8IKUalrnlzQ6UVQ6Y Q==; X-CSE-ConnectionGUID: 5qouyMk/RvOrVkbLOXX8dg== X-CSE-MsgGUID: QOszDEg5QEeoJ58IWhuYqQ== X-IPAS-Result: A0BKAgDpwNFq/4r/Ja1aHgE8DA4LgVmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AgJAAVDYSxBvgWgBCxQBgTiFQIgjXRgBhHwnG4FJRIEVg2mBBYFcAgIYiAsEgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghg7Ej0bCS0BK4JKBqVRoQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:Tolbya7N05Uor1M51QglPwxRtG/GchMFZxGqfqrLsTDasY5as4F+v mdOXjyFb6rfamShKNF2b9++pBkOupOGyINgSVE5qC09Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eYJQf5/dSAiZ06 9sCFjMHSjezt7K6z+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGcmFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkYfUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4SKIIbVHp49ckCwn 0Xd7UjUDUwjGdGY62fV002sm97WpHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rAnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:aDL4j68NmaWeD/XM02Juk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:oe/TSW+4mCp5IaB8pdKVvxMNHd00V36a9mn3OXG7A0JOeI3FRVDFrQ== X-Talos-MUID: 9a23:4llgwwqxa0yy+VVwkEAezwhFL9VEzqvzMW0Alrdb6+i7NTFBIg7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722733" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 92B291800028F for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id ECDC8CC124E; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 08/27] python3-git: fix CVE-2026-73623 Date: Thu, 15 Oct 2026 23:19:03 -0700 Message-Id: <20261016061922.843414-9-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247980 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97 [2] https://www.cve.org/CVERecord?id=CVE-2026-73623 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73623.patch | 54 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch new file mode 100644 index 0000000000..ebfa4a1fab --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch @@ -0,0 +1,54 @@ +From 915629fa543e06f6066441f8ba13c68f89304104 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:43:26 +0200 +Subject: [PATCH 16/38] fix: reject unsafe clone templates + + + +Treat git clone --template as unsafe because caller-controlled +templates can install hooks that execute during clone. + +Add regression coverage for both direct option and keyword forms. + +References GHSA-6p8h-3wgx-97gf. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73623 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit ffcb5359e87619f4fe4a70a4aff5f08c5580ba97) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 0440a92d..0d4fae8a 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -140,6 +140,8 @@ class Repo: + # Can override configuration variables that execute arbitrary commands: + "--config", + "-c", ++ # Can install hooks that execute during clone: ++ "--template", + ] + """Options to ``git clone`` that allow arbitrary commands to be executed. + +@@ -150,6 +152,9 @@ class Repo: + The ``--config``/``-c`` option allows users to override configuration variables like + ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt ++ ++ The ``--template`` option can install hooks that execute during clone: ++ https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory + """ + + unsafe_git_archive_options = [ +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 18132b8af9..959186eeee 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -29,6 +29,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ + file://CVE-2026-73623.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101031 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A5D2CCF2C4 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15611.1792131564294051812 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=WUPbhfUS; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6697; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=VeEmC4iO4NTRIEMAzt+NrmS5wAEiz41cN0mSMubY+f8=; b=WUPbhfUSSDWHVx/O9n5BThom0ODUm0/PhfSMvo07hlooTFrXnE9WNGlv jf5Y4XE+NpDgp8GrKZtPqMqcLISgiGg3e64BTkXHVZqUdipMgq4Qti2mn j90QHM5zSCD3N+GOJzaSfLMck0dq+fuWzsi/hDgsiUJRsF4n3Hy9A8Pqd ew/aIZvEYRuGPyt0gImtVJbqbkp+7xAX3MPsxzVS86c4ZBkUDS2LFbv8M CzgCGjG1XACUl1DVqgBsTMvHZMsT9cLJ2J4mGQZOLchIy2YxTKi9GL8L9 s+4ZMTFfHoPV9R2gozP0orfJUKps43JGfuYxWHKj3lzyyg2EFC9fWGM8N Q==; X-CSE-ConnectionGUID: n8S5b9cKS1qk1cnG6lxBKg== X-CSE-MsgGUID: 7Da825RsRVaqI5ZVWWmllg== X-IPAS-Result: A0BIAgDpwNFq/5P/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYMZgWMnG4FJRIEVg2mBBYFcAgIYiAsEgxwSgVqBA4c2jQ5IgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJk0xDD4TASuCUCcDkmiSP6EPhCiMIpU6GjOEBIFXkkCSVAuYfY4Klk+EaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:UoBlsam25WwC+lnkCe61hqvo5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJMUD2FP/yIYmbzf9ElO9/n9kMF7MLdmtNlSlNupC9kEFtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FYtIwbt9UGptz qUBK2kGaD/dg/Kc473uH4GAhux7RCXqFJkUtnclyXTSCuwrBMmbBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZT/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYCPIoXVHJkJ9qqej j3q9jSjXysBDuKW0BvYwEyTuerLmSyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:iZCF86zjIe67Q8UxC4SfKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:CJCboWMqvh8CUO5DXnlcqURFEeMeK2TelXzWDBG8GUxKR+jA X-Talos-MUID: 9a23:PmJesgaOfCoSo+BT6BPl1Gs/DtxS3a23KR0/r6o5vs2AOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522017144" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 99DFC18000A50 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id F3DBCCC124F; Thu, 15 Oct 2026 23:19:22 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 09/27] python3-git: fix CVE-2026-73624 Date: Thu, 15 Oct 2026 23:19:04 -0700 Message-Id: <20261016061922.843414-10-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247981 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6 [2] https://www.cve.org/CVERecord?id=CVE-2026-73624 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73624.patch | 135 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 136 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch new file mode 100644 index 0000000000..b44e805f06 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch @@ -0,0 +1,135 @@ +From fc5d625a6c45ac58a59dcf8fef246635080a1cbb Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:46:13 +0200 +Subject: [PATCH 17/38] fix: guard diff output options + + + +Reject unsafe diff options before revision parsing or Git invocation so +callers cannot write command output to arbitrary filesystem paths. + +Cover commit and index diffs, including option-like revisions, and +preserve an explicit allow_unsafe_options escape hatch. + +References GHSA-fjr4-x663-mwxc. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73624 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6] + +Backport Changes: +- Omit upstream regression test changes because the current + PyPI source archive does not include its test suite. +- Use the Scarthgap IndexFile.Index spelling while carrying + the upstream guard into the existing API. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 1d51b891d7f236044a6aa17498ec682b63dad6e6) +Signed-off-by: Yogita Urade +--- + git/diff.py | 15 +++++++++++++-- + git/index/base.py | 17 +++++++++++++++-- + 2 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index aba1a108..37ff2624 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -5,7 +5,7 @@ + + import re + +-from git.cmd import handle_process_output ++from git.cmd import Git, handle_process_output + from git.compat import defenc + from git.util import finalize_process, hex_to_bin + +@@ -109,6 +109,7 @@ class Diffable: + other: Union[Type["Index"], "Tree", "Commit", None, str, object] = Index, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "DiffIndex": + """Create diffs between two items being trees, trees and index or an +@@ -134,6 +135,10 @@ class Diffable: + applied makes the self to other. Patches are somewhat costly as blobs have + to be read and diffed. + ++ :param allow_unsafe_options: ++ If ``True``, allow options such as ``--output`` that can write to arbitrary ++ filesystem paths. ++ + :param kwargs: + Additional arguments passed to git-diff, such as ``R=True`` to swap both + sides of the diff. +@@ -145,7 +150,13 @@ class Diffable: + :class:`~Diffable.Index`, or as :class:`~git.objects.tree.Tree` or + :class:`~git.objects.commit.Commit`, or a git command error will occur. + """ +- args: List[Union[PathLike, Diffable, Type["Diffable.Index"], object]] = [] ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) ++ ++ args: List[Union[PathLike, Diffable]] = [] + args.append("--abbrev=40") # We need full shas. + args.append("--full-index") # Get full index paths, not only filenames. + +diff --git a/git/index/base.py b/git/index/base.py +index 9d1db4e3..c3d1771c 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -19,6 +19,7 @@ from git.compat import ( + force_bytes, + defenc, + ) ++from git.cmd import Git + from git.exc import GitCommandError, CheckoutError, GitError, InvalidGitRepositoryError + from git.objects import ( + Blob, +@@ -1411,6 +1412,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + other: Union[Type["git_diff.Diffable.Index"], "Tree", "Commit", str, None] = git_diff.Diffable.Index, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> git_diff.DiffIndex: + """Diff this index against the working copy or a Tree or Commit object. +@@ -1422,6 +1424,11 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + Will only work with indices that represent the default git index as + they have not been initialized with a stream. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) + + # Only run if we are the default repository index. + if self._file_path != self._index_path(): +@@ -1441,7 +1448,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + # Invert the existing R flag. + cur_val = kwargs.get("R", False) + kwargs["R"] = not cur_val +- return other.diff(self.Index, paths, create_patch, **kwargs) ++ return other.diff( ++ self.Index, ++ paths, ++ create_patch, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + # END diff against other item handling + + # If other is not None here, something is wrong. +@@ -1449,4 +1462,4 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + raise ValueError("other must be None, Diffable.Index, a Tree or Commit, was %r" % other) + + # Diff against working copy - can be handled by superclass natively. +- return super().diff(other, paths, create_patch, **kwargs) ++ return super().diff(other, paths, create_patch, allow_unsafe_options=allow_unsafe_options, **kwargs) +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 959186eeee..734144dc31 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -30,6 +30,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ + file://CVE-2026-73624.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101044 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 530ADCC6B38 for ; Fri, 16 Oct 2026 06:19:45 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15906.1792131584148701298 for ; Thu, 15 Oct 2026 23:19:44 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=iEhk4jto; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3963; q=dns/txt; s=iport01; t=1792131584; x=1793341184; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=7/kQm587nbe+x+KnDxryISvMtRaOXYPz3B2oiXrVX0A=; b=iEhk4jtoWUiQ7to1U1ro9z/YYnc4wblM08c3KXKDGdfO8vNJjOJIsYVF RHhz3vsp3fEMLBFWenNVcHqJt0Z1/5tox8eAk/LLvk3Wetc3JVmUqisv+ 4LQhmzciukQGzQxQPZhtAT8xeyoifelmgu7g7DrN1YSn4e64da0/fKKfO NdUtgPIBRXcZVxxFPqIhOQpx7P07chLnxxsJ+G/OVz6M5Ks8J0Iqyl9Qn +BbTCfg5HOGU6b9nNL0mjJrCxBMqN4ZGifXj60+ER3seJ/efP2mk0EpOo SGfQ9q6/eadn4IS/1o7j5uhBcOVkrX4A/vDr/vGpsDs0CxNiDiiF+id78 A==; X-CSE-ConnectionGUID: ea2wPSgaR9eA0Mp7fuuydw== X-CSE-MsgGUID: RC4d27mTTm27hXCofdnTIg== X-IPAS-Result: A0BIAgBfwdFq/5X/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAzIBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHOCLIEBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEhH6BBYEyKgICGIgLBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYOxI9UQErgUMKgQEYoxqCIaEPhCiMIocnjhMaM4VbpRQLmH2OCpVjHFCEaYFoPIFZMxoIGxWDIglKGQ+OOYNrhRNRyHYnMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:9zkVBK4RYBldL9mu04hyBwxRtG/GchMFZxGqfqrLsTDasY5as4F+v jdLDGuPaayIMDGhfdtyYYTioBhTv5bXzNI3Twplqy88Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eMIRC5d5MDmh0p PExcBUVMR6emvO63+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGMqFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEeUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4SJKoHXHps9ckCwn Ema8z6mBy0mMYbAyQqu9XyggNPuknauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPAXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rNnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:U5tOtqnNHjH/eRNY+EcQc9znhQfpDfIA3DAbv31ZSRFFG/Fw8P re+MjzuiWbtN98YhwdcJW7Scq9qBDnhPtICPcqXItKNTOO0ADDEGgh1/qB/9SKIULDH4BmuZ uIC5IfNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:8EXI+ml+Jm/5z2HwaCP+tZ+J7g/XOXDUlmjoGECxMzdkYeWwUQCe5b51n9U7zg== X-Talos-MUID: 9a23:+YalagbxzxW9zuBTjRSwiGs9MftU5v7xCHAmlpsKvfWlOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536485536" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 9D61A18000301 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 05DD0CC1250; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 10/27] python3-git: fix CVE-2026-73622 Date: Thu, 15 Oct 2026 23:19:05 -0700 Message-Id: <20261016061922.843414-11-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247991 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162 [2] https://www.cve.org/CVERecord?id=CVE-2026-73622 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73622.patch | 61 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch new file mode 100644 index 0000000000..e8df692c03 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch @@ -0,0 +1,61 @@ +From 6bb3d376f6e22140b5ff3d1d4c67c1408ee7e4e6 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 15:42:44 +0200 +Subject: [PATCH 18/38] fix: prevent environment expansion in remote URLs + +Remote and submodule creation expanded environment-variable references in +caller-supplied URLs before storing them in Git configuration. This could +expose process environment values through a later network request or a tracked +.gitmodules file. + +Preserve variables literally in the remaining untrusted URL callers while +retaining Git.polish_url() expansion for intentional local-path normalization. +Add regression tests covering remote configuration and submodule configuration. + +Git baseline: git remote add and git submodule add accept URL arguments +literally; Git does not perform shell-style environment expansion on those +arguments. + +CVE: CVE-2026-73622 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 863417457a0633db7ea5aed4fd01e0b291a41162) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + git/remote.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index d08e967b..4fe2ff3f 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -516,7 +516,7 @@ class Submodule(IndexObject, TraversableIterableObj): + # END verify url + + ## See #525 for ensuring git URLs in config-files are valid under Windows. +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + + # It's important to add the URL to the parent config, to let `git submodule` know. + # Otherwise there is a '-' character in front of the submodule listing: +diff --git a/git/remote.py b/git/remote.py +index 25e076f3..28fd35a5 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -759,7 +759,7 @@ class Remote(LazyMixin, IterableObj): + """ + scmd = "add" + kwargs["insert_kwargs_after"] = scmd +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(url) + repo.git.remote(scmd, "--", name, url, **kwargs) +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 734144dc31..fe809b2229 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -31,6 +31,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ + file://CVE-2026-73622.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101030 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06D36CCF2C2 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15902.1792131565169883842 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=CmWvtYfN; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4504; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=UyxD81cF7MRkVCLshB97amFeYOcpofzZ8gwRSS3Kq7U=; b=CmWvtYfNcoj7LrtBzyGwrWaxVr9zBwyqcPvDVS1jlKJgIq7Gvlb4ODp0 rciVuZuaZcIX9dtvRgagxWELtMlnMh6xNhAA/W8JFZhO88ScjVb3IozBz ftW1ddVmPyJEMvexE/y3GXD1p5hoQz0gSUydDPu59zH2O0LxjUipbucfi u7zKzQw7SwbXzD2W5vUO2yNrsh+P+KbWJN0xdvCCsBjD0be6cuNKwSwIg PFmEglO7B/CzDM2XEf5a2ixcIcfLekgumL6MTdsjEfUKrpZfj0tofHyXO EQQA24x+tn9aH60b2Z40WQDoaBS8qKNGDy+hDMjxD/+Kt/RWF8k2FPq0O g==; X-CSE-ConnectionGUID: b5j3KMYMT0SayD96V21XQg== X-CSE-MsgGUID: H9/MBVSDRlOt9jsH8GwJag== X-IPAS-Result: A0BKAgDpwNFq/5D/Ja1aHgE8DA4LgVmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYMZgWMnG4FJRIEVg2mBBYFcAgIYiAsEgg2BDxKBWoEDhAuQOUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImRgc9UQEQGwSBAYE2pWahD4QojCKVOhozhVulFAuYfY4KlWYcTYRpgWg8gVkzGggbFTuCZwlKGQ+OLgsLg2CFE1FsyAonMgIJMgEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:uwF10a8oKaqA704AbIDxDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3y WYaD2CGbqmMajf2Kt53OoTg9UlU756GyN5mHlY5pC5EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k8YI9D2cNGJF0Wz vUJBGFTUErat9u5lefTpulE3qzPLeHxN48Z/3UlxjbDALN+HtbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0En1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2boWPIIPRGa25mG649 yXj1VrCLiseE8DOyyGlol2zpObAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYS/1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:2RtKbqiIR5Tx8VI9n6Im/FgKVnBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:pDtws2zmtXY7VlNIhgNABgUeR8J+UVjs6UuIGEapJTc3dufMeWafrfY= X-Talos-MUID: 9a23:HEi7zg0sE4GmYPT+N1k2/I7lPTUjw/XpLWozqrk8v+6YZC5rG2eykxa+Tdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722734" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 9CEE8180003CB for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 0BF10CC1251; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 11/27] python3-git: fix CVE-2026-73621 Date: Thu, 15 Oct 2026 23:19:06 -0700 Message-Id: <20261016061922.843414-12-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247982 This patch applies the upstream fix as referenced in [2], using the commit shown in [1] [1] https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2 [2] https://www.cve.org/CVERecord?id=CVE-2026-73621 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73621.patch | 76 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch new file mode 100644 index 0000000000..4f17cdc23c --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch @@ -0,0 +1,76 @@ +From f4029fab1d9f47bd31ccd8334f433249c430e0a4 Mon Sep 17 00:00:00 2001 +From: Sebastian Thiel +Date: Sat, 25 Jul 2026 06:27:01 +0200 +Subject: [PATCH 19/38] fix: reject unsafe output options in Commit.count + + + +Commit.count forwards keyword arguments to git rev-list but did not apply the +unsafe-option validation used by the sibling revision APIs. + +Validate forwarded options with the existing Git.check_unsafe_options helper +and retain the explicit allow_unsafe_options escape hatch. This covers +GHSA-p538-c434-8v24 without adding another option parser. + +Git baseline: git.git a23bace963 defines --output as a shared diff option +consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option +with rev-list. + +CVE: CVE-2026-73621 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Co-authored-by: GPT 5.6 +(cherry picked from commit 38553b6fddc7f6a667cdb45a6762343a08fc72b2) +Signed-off-by: Yogita Urade +--- + git/objects/commit.py | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/git/objects/commit.py b/git/objects/commit.py +index ae60d286..ff852489 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -241,21 +241,34 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + else: + return self.message.split(b"\n", 1)[0] + +- def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int: ++ def count( ++ self, ++ paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> int: + """Count the number of commits reachable from this commit. + + :param paths: + An optional path or a list of paths restricting the return value + to commits actually containing the paths. + ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--output``. ++ + :param kwargs: + Additional options to be passed to git-rev-list. They must not alter + the output style of the command, or parsing will yield incorrect results. + + :return: An int defining the number of reachable commits + """ +- # Yes, it makes a difference whether empty paths are given or not in our case +- # as the empty paths version will ignore merge commits for some reason. ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options ++ ) ++ ++ # Yes, it makes a difference whether empty paths are given or not in our case as ++ # the empty paths version will ignore merge commits for some reason. + if paths: + return len(self.repo.git.rev_list(self.hexsha, "--", paths, **kwargs).splitlines()) + return len(self.repo.git.rev_list(self.hexsha, **kwargs).splitlines()) +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index fe809b2229..5bbb20c842 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -32,6 +32,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ + file://CVE-2026-73621.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101029 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA37FCCF2C0 for ; Fri, 16 Oct 2026 06:19:33 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15900.1792131564578225035 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IBg2lxjA; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6053; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=v0hln6U+l+r13Qop30OQpn79v7703p7H4tqAqCuNwWQ=; b=IBg2lxjAsi+xvGVibq+WGxntxe4GRSDNhGueRzk8ytbSMpAKdYq+l9L0 et7aekZa1slbD0TajMyXVIMKOX4NyPmMkCOvXJ9nVTqP2qJP0JNVSz1h9 Y+sMSKQg4RP8H6Wc61Rnoc2KoVQo+jHGRddnkOZZ6y7DlPA3WERy7SGUj n+AQl5kk6TxrhLu0G+wuYnAnhP1ox+z2edozigzm+UbPf4NrlDZHMdVwo XF5M/dz51joXjgA7XWcURlX3/hQho73HWFeTACQVwC8aEmydYtJfyDurG cOV9JRz9q1ayxzRcXkHXgxT8ym6WTeZvu9sn6LLzh+BWmg5jJvllraqUI w==; X-CSE-ConnectionGUID: TCQ317BmTNGxZi9zikhNEg== X-CSE-MsgGUID: DU+9uQWpQySeYSYExdh3gA== X-IPAS-Result: A0BIAgDpwNFq/5P/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIgLBIINgQ8SgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImLQ4SATxRARAbgjJIkyKSBYE1n1qEKIwilToaM4QEgVeSQJJUC5h9jgqWT4RpgWg8gVkzGggbFYMiCUoZD445g2uFE1HIdicyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:M7mtj6iQuRZD2KOgOpkuFSysX161NxEKZh0ujC45NGQN5FlHY01je htvUTqAPfaNMGTwc99xbo2290xSuJeBytFqQFRlqy1nFHxjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUk0d8sWD5k8 MA+ByA/b0GRhuG25p+0H7wEasQLdKEHPasFsX1miDWcBvE8TNWaG+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgh/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJITRGpoIxy50o ErqwieoHyglLOWO8je0yUOBluPPxizSDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzFcCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:f34WiKqdXYkuLFn97wyIUFIaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:rsAFNmiC44u8ty3BQCQUUtDxdDJuTlbkly6PCUqEL0l5erzEW16T+IVJnJ87 X-Talos-MUID: 9a23:dpDYwQUJYmcMqb/q/BPRx2B/Dfhw2rWVBXE2oLgWt8nfOgUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536037751" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 9FD6818000A6D for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 123A2CC1253; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 12/27] python3-git: fix CVE-2026-73620 Date: Thu, 15 Oct 2026 23:19:07 -0700 Message-Id: <20261016061922.843414-13-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247973 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c [2] https://www.cve.org/CVERecord?id=CVE-2026-73620 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73620.patch | 130 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 131 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch new file mode 100644 index 0000000000..9b26f7bf0a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch @@ -0,0 +1,130 @@ +From 5cb503e8d600c1946ed57e720dcee1a31dd5a65e Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 05:54:27 +0200 +Subject: [PATCH 20/38] Block unsafe checkout-index and tag file options + +GHSA-3f7w-8rr8-f37f reports that caller-controlled options forwarded by +IndexFile.checkout() and TagReference.create() can make Git write to or read +from arbitrary filesystem paths. + +Add regression coverage proving the unsafe options are rejected by default while +preserving the explicit allow_unsafe_options escape hatch. Reuse GitPython's +existing option candidate normalization and unsafe-option guard at both public +API boundaries. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-checkout-index.adoc defines --prefix as prepending an output +path, and Documentation/git-tag.adoc defines -F/--file as reading a tag message +from a file. + +CVE: CVE-2026-73620 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 3af0c2516c5e18c829da30338614688f6b69b49c) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 12 ++++++++++++ + git/refs/tag.py | 13 +++++++++++++ + 2 files changed, 25 insertions(+) + +diff --git a/git/index/base.py b/git/index/base.py +index c3d1771c..687b72da 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -141,6 +141,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + before operating on it using the git command. + """ + ++ unsafe_git_checkout_index_options = ["--prefix"] ++ + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") + + _VERSION = 2 +@@ -1156,6 +1158,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + paths: Union[None, Iterable[PathLike]] = None, + force: bool = False, + fprogress: Callable = lambda *args: None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Union[None, Iterator[PathLike], Sequence[PathLike]]: + """Check out the given paths or all files from the version known to the index +@@ -1179,6 +1182,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + explicit paths are given. Otherwise progress information will be send + prior and after a file has been checked out. + ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--prefix``. ++ + :param kwargs: + Additional arguments to be passed to git-checkout-index. + +@@ -1200,6 +1206,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + different to *head.checkout*, i.e. if you want git-checkout like behaviour, + use head.checkout instead of index.checkout. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_checkout_index_options, ++ ) ++ + args = ["--index"] + if force: + args.append("--force") +diff --git a/git/refs/tag.py b/git/refs/tag.py +index a59a5133..640e9702 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -2,6 +2,7 @@ + # 3-Clause BSD License: https://opensource.org/license/bsd-3-clause/ + + from .reference import Reference ++from git.cmd import Git + + __all__ = ["TagReference", "Tag"] + +@@ -36,6 +37,8 @@ class TagReference(Reference): + + __slots__ = () + ++ unsafe_git_tag_options = ["--file", "-F"] ++ + _common_default = "tags" + _common_path_default = Reference._common_path_default + "/" + _common_default + +@@ -83,6 +86,7 @@ class TagReference(Reference): + reference: Union[str, "SymbolicReference"] = "HEAD", + logmsg: Union[str, None] = None, + force: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "TagReference": + """Create a new tag reference. +@@ -108,11 +112,20 @@ class TagReference(Reference): + :param force: + If True, force creation of a tag even though that tag already exists. + ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--file``. ++ + :param kwargs: + Additional keyword arguments to be passed to git-tag. + + :return: A new TagReference. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_tag_options, ++ ) ++ + if "ref" in kwargs and kwargs["ref"]: + reference = kwargs["ref"] + +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 5bbb20c842..3f04fe8fdb 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -33,6 +33,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ + file://CVE-2026-73620.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101045 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65E2BCCA46D for ; Fri, 16 Oct 2026 06:19:45 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15906.1792131584148701298 for ; Thu, 15 Oct 2026 23:19:44 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=kw4kNbsQ; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3611; q=dns/txt; s=iport01; t=1792131584; x=1793341184; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=UGGMSQXyJEskXu79yaVQdsgYqOI7iIr732pI35kJPjg=; b=kw4kNbsQUdmudtMC2oJDzcGtsUXgohjd1dlDbOM4AaA/H7ZVGdDFgKki m+TimcCgA0kW0xvk9RocvF8xvM17eifj2vyFIwlDCsooxflpvtQAUE0vb BFKpiA9d5/pEHQ/2suMkowVDw5sdZtvGmzQgm7oqDcMVb4My6M4CUQQUm ujtrZorVZdOCsKBAK1bpExHh2yujZ+KyBraX19nS6GNAdgKrAs2WfY3/k h8jyqB2eVlB375GaC6yQdxmyLzuu2uhU0SMr+sg+eFKKJbIQkUaZJWVF2 Zj1Fbsr9SYqWfkjTv0Vv3GAutyBzyGneTEqNdr/8vrA/5w10i+VxwkjNI Q==; X-CSE-ConnectionGUID: E+fRQA+GTjaZrY3FYXoXEw== X-CSE-MsgGUID: kNQCnlHtTQOdxsnIIynv8Q== X-IPAS-Result: A0AaAABfwdFq/5D/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKHN4IhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAzIBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHOCLIEBgykBPwJDUNhLEG+BaAELFAGBOAGFP4gjXRgBhHwnG4FJRIEVg2mBBYFcAgIYiAsEgxwSgVqBA5RESIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6BciYtDhI9TwIBK6ghoQ+EKIwilToaM4VbpRQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:xiTS16ov9Dg7zOY7sdery2hlwTxeBmJPZBIvgKrLsJaIsI4StFCzt garIBmAOa6PZWb0KNh/a47n90JXv5eHzoJnHlRvqysxRi0V+OPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0ss0D1t33 L83FDIEXAqy3MyH8LWLZ/Y506zPLOGzVG8ekmtrwTecCbMtRorOBv2Vo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVPrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUGZUIwx3Hz o7A12ffOzocMPyD9QOi/mK3gM7ujCXlCLtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmEHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn28/Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:2N4uuK6xyb3ZJXvj7APXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:bJx9cmraa0WIwrgiYUuj28fmUe1mfEfk5TT/H02xO3xYE5OkeVig1bwxxg== X-Talos-MUID: 9a23:+/l/6Qoub3bB3C1qGzoezzJEDexu54SyNHkqnYUdveilJCpuaw7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536485537" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id A59D8180003F2 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 187A9CC1261; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 13/27] python3-git: fix CVE-2026-73619 Date: Thu, 15 Oct 2026 23:19:08 -0700 Message-Id: <20261016061922.843414-14-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247992 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca [2] https://www.cve.org/CVERecord?id=CVE-2026-73619 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-73619.patch | 59 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch new file mode 100644 index 0000000000..9ef25fd959 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73619.patch @@ -0,0 +1,59 @@ +From 03c9b0fc2530fb81d15bf3f41f39da7e2308289c Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 06:00:59 +0200 +Subject: [PATCH 21/38] Block unsafe archive additions and bundle URI + +GHSA-539m-9xh6-q6rr reports incomplete unsafe option lists for archive inputs +and clone bundle URLs. Caller-controlled archive additions can expose or inject +filesystem content, while clone --bundle-uri can dereference an additional +caller-controlled URL. + +Extend the existing archive denylist with --add-file and --add-virtual-file, +and the clone denylist with --bundle-uri. Regression coverage exercises archive +kwargs plus both clone multi-option and keyword paths. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-archive.adoc defines --add-file/--add-virtual-file, and +Documentation/git-clone.adoc defines --bundle-uri as fetching from the supplied +URI. + +CVE: CVE-2026-73619 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 0d4fae8a..7142f220 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -142,6 +142,8 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", ++ # Fetches from a caller-controlled URL: ++ "--bundle-uri", + ] + """Options to ``git clone`` that allow arbitrary commands to be executed. + +@@ -163,6 +165,10 @@ class Repo: + # Writes output to a caller-controlled filesystem path. + "--output", + "-o", ++ # Reads from a caller-controlled filesystem path: ++ "--add-file", ++ # Injects a caller-controlled path and contents: ++ "--add-virtual-file", + ] + + unsafe_git_revision_options = [ +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 3f04fe8fdb..c2fbc65db2 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -34,6 +34,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ file://CVE-2026-73620.patch \ + file://CVE-2026-73619.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101033 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 381AFCCF2C3 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15611.1792131564294051812 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=FLB6Xoqy; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4341; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Sl/pkL+VcBJDUZfsfOM27d3EqDYFYzuyly1e2f8aoco=; b=FLB6XoqyLfvhwlkRp3y/K0TLVKn8dYL4aRBDBAHxWG8hKyDVwEe9oPsF l3oSxBw2ALF9I9KiNKT1HZchWxgRNyLtvDW9YyWrO7WFBi9MjwJSv8Uqb dixtlZq5H/pCFkE39kCat5zzLnPEaNBQSFVVYfKgo9iULMrI9VYRTISz6 SaFX2u4MdxEDFefhazdx1ZKzKkyeHuOiEi9qUzl9yUbUDoG1v45aFff0I eJ1F4pNDZQXLTRzpgDmmOu6z+rKMRFLNqDPjwFQTUVLj4aI9EMcRtAABh z4uXRlAZErfBBgo5ZjvZq1KDx3+XjUWKQkmVsMPjik2TQTth0Dsr2TaK3 A==; X-CSE-ConnectionGUID: 0kcxEX/rTpiWYg7kqFHymA== X-CSE-MsgGUID: bPH9apEdQy20oTj+PzM7mw== X-IPAS-Result: A0BIAgDpwNFq/5P/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGCZkMBPwICQAFQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIgLBIMcEoFaHpUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGEwBHx4kLQErRlqUQ5AdgiGhD4QojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:B6Xjl61fjovvnnATjvbD5YRwkn2cJEfYwER7XKvMYLTBsI5bpzxSz TYXCmrTOv2KM2v2f951a4rg9EIH75Lcy4NhSAtu3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGVEI9LaAovfxLGWBxx PNHKykjTgGGrrfjqF67YrEEasULNsLnOsYb/3pn1zycVK5gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUifC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsiuK1aYWMJoLiqcN9lH649 2ve0mjAE0tCM+CdigKX1y2pmbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Nu0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:LZz9xqhW95ntsvnpQl8dBkqeu3BQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:IFQp7mr03nQh9HA6jsV2bdDmUZgmeW3w/DDKH1e5NldmF76MZ3+B/Yoxxg== X-Talos-MUID: 9a23:wDBDAAo5Ya2+YwP0ysEezztaFJZh+4miMVFXyZI6uYq8JwkvPijI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522017146" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:23 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id AA8F418000A75 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 1EB75CC1600; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 14/27] python3-git: fix CVE-2026-76221 Date: Thu, 15 Oct 2026 23:19:09 -0700 Message-Id: <20261016061922.843414-15-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247986 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf [2] https://www.cve.org/CVERecord?id=CVE-2026-76221 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76221.patch | 61 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch new file mode 100644 index 0000000000..ef6e591e7d --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch @@ -0,0 +1,61 @@ +From 46f9c03ed10d25146293003791476955f8b26a73 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:57:12 +0000 +Subject: [PATCH 22/38] Reject syntax-bearing git config option names + + +GHSA-jm78-9fvv-mhgr reports that config option names containing Git +syntax can be serialized as unintended directives. A regression test showed +that set, set_value, and add_value accepted delimiter, comment, bracket, and +whitespace characters in option names. + +Restrict written option names to GitPython's established safe character set of +letters, digits, hyphens, underscores, and dots. This blocks characters that +can change config syntax while preserving option names historically supported +by the writer and SectionConstraint. + +A broader audit confirmed that every public option-creating config API and +SectionConstraint delegate reaches this validator; no separate config writer +sink was found. The behavior was checked against Git cf5497b14, and the full +config test module plus dotted-option regression pass. + +CVE: CVE-2026-76221 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit a495ccd3b547ccd60b2187215823b72a9c0188bf) +Signed-off-by: Yogita Urade +--- + git/config.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/git/config.py b/git/config.py +index 3015bb73..ff88bd18 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -74,6 +74,9 @@ See: https://git-scm.com/docs/git-config#_conditional_includes + UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") + """Characters that cannot be safely written in config names or values.""" + ++VALID_CONFIG_OPTION_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$") ++"""Pattern for option names that can be written without changing config syntax.""" ++ + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 + """Utility class wrapping base-class methods into decorators that assure read-only properties.""" +@@ -854,6 +857,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "option" and isinstance(name, str) and not VALID_CONFIG_OPTION_NAME_RE.fullmatch(name): ++ raise ValueError("Git config option names may contain only letters, digits, '-', '_', or '.'") + if label == "section" and isinstance(name, str): + in_quotes = False + escaped = False +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index c2fbc65db2..80cdc59f92 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -35,6 +35,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73621.patch \ file://CVE-2026-73620.patch \ file://CVE-2026-73619.patch \ + file://CVE-2026-76221.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101036 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7437FCCF2C6 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15900.1792131564578225035 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Pqi0rnew; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4144; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=g45VyjM9lRj4Rm1wPZa4W1PxjHCA+qI5CWGqPZKsu+U=; b=Pqi0rnewYAU+ZSHdZ8MSMLc2BCeqnMYz//0RDnJVBtG9J64UqtmGq9UB fX6in02/YC1bUlQV9qABLvrP9Wbe+KXrWVaOQIf51CRYAkkjsYI07lMKH 1z7SwVUzUdhF06F7/15VhBTwi2lO2Eat6pYSqygFB6MriNJw7xFm+6Gwd 5WN0obUn6I/aESWWbUydvqWh2UvKVbgBOndXmWoHPAIw7ycC/0uY9FGbd ItDT2DkAKbXRxNFY9LSt/ARR24ScOj+WTjZ+zQDfSvEghvncLA7aZZkon 7E8gXu49oGZyNIGM74lvTAPjL9mL3bwZwqcg+sZjAryPIIyTlwgtI7b5z g==; X-CSE-ConnectionGUID: OPfn20qYRmqptj6Lt6ZyIA== X-CSE-MsgGUID: ZmgIJI5ITbW5/vWg7L4ShA== X-IPAS-Result: A0BJAgDpwNFq/4v/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWDaYEFgVwCAhiICwSDHBKBWoEDlERIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYTQEeHlEBCiGBIC2mVKEPhCiMIpU6GjOqbwuYfY4Klk+EaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUch2JzICBgMyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:Q9Uri665bsW4sMHKIpTKfQxRtG/GchMFZxGqfqrLsTDasY5as4F+v jceDz2CM/qPMWXyeopzatvipkIF7JaHyN9mSQZr+ChmZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eGrUW/LwvGFB08 OUANDJTSgzdtfOX6efuIgVsrpxLwMjDJogTvDRkiDreF/tjGcqFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkYeUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4SNIYPVGJ49ckCwl GfJ3kbYXzAmPuPCjiS6/S2I2tTPtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:LkDLjK3VeGNW+SsZrtNHrwqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:y2wKHW1uvCV5Cptish2IGrxfPfgrdCeF1UbqJlagFWQ3bKHLe06x0fYx X-Talos-MUID: 9a23:TYx1qQnC0Fxs1iFsJKHKdnpQMchJwYXzKXwHrshBpfaLaggsADe02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536037753" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id E67631800022B for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 24644CC1633; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 15/27] python3-git: fix CVE-2026-76220 Date: Thu, 15 Oct 2026 23:19:10 -0700 Message-Id: <20261016061922.843414-16-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247977 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541 [2] https://www.cve.org/CVERecord?id=CVE-2026-76220 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76220.patch | 66 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch new file mode 100644 index 0000000000..cf88138008 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch @@ -0,0 +1,66 @@ +From a45e209e84248dbddbbbddae5c31d057ef00bfec Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:59:57 +0000 +Subject: [PATCH 23/38] Check joined short-option values before Git execution + + +GHSA-wvpp-8hx9-p66j reports that unsafe-option checks omitted the value +joined to a one-character option when split_single_char_options was false. A +regression test reproduced the mismatch: GitPython checked only -n even though +it emitted a joined -nVALUE token that Git parses as clustered short options. + +Collect the exact joined token for unsplit one-character keyword arguments so +the existing clustered-short-option validation sees every option character. +The split form and long-option behavior remain unchanged. + +A broader audit confirmed that all guarded keyword-forwarding APIs use +_option_candidates, including clone, ls-remote, fetch, pull, push, archive, +revision, diff, checkout-index, and tag paths. Git cf5497b14 confirms repeated +short-option parsing within a joined token. Focused candidate and unsafe-option +tests pass. + +CVE: CVE-2026-76220 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 96a888f4d782cb2f80452148e48e60ce4af6d541) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index f907fa4e..b1aef9d3 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -638,13 +638,21 @@ class Git(LazyMixin): + values = value if isinstance(value, (list, tuple)) else (value,) + if any(value is True or (value is not False and value is not None) for value in values): + key = str(key) +- options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") +- if len(key) == 1 and split_single_char_options: ++ if len(key) != 1: ++ options.append(f"--{dashify(key)}") ++ elif split_single_char_options: ++ options.append(f"-{key}") + options.extend( + str(value) + for value in values + if value is not True and value not in (False, None) and str(value).startswith("-") + ) ++ else: ++ options.extend( ++ f"-{key}" if value is True else f"-{key}{value}" ++ for value in values ++ if value is True or (value is not False and value is not None) ++ ) + return options + class AutoInterrupt: + """Process wrapper that terminates the wrapped process on finalization. +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 80cdc59f92..37de657041 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -36,6 +36,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73620.patch \ file://CVE-2026-73619.patch \ file://CVE-2026-76221.patch \ + file://CVE-2026-76220.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101032 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50109CCF2C5 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15613.1792131564997766691 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=d0vWiiqy; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8093; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+HeVOYwMITN8czYDrjJQURBA90JnXMiX5bq8w1jkTdE=; b=d0vWiiqyJFemQ1sKuzOnJonYmptnfAOWmSmlDFyTcBhypGWSmYkaIkpF WVgOvdIbnT4vX2SSproM/3f/AfZdMq+dz2oB/24pLpZM2rSD3afQ2hsj1 SOhdC1IbXDVqG4X05uI3rhZsBz5vLUdtV9+GZWsXQPx9wp2y4dSgPDZok Vwq+GGWTqicZu0yuRcKZP+Hd3gmE1IHYI480SWw9cwnrFXV9o2fnONQ91 xVAvCBbhQz6ZGBW4/BWK6A9vuo4lPLS7WPspgcw3mFBPqf0zxVRpk7Dfz jo5/ZLggl30h4Tb4LHTMbWg7JeTSmyd+hBP08Kh10L5ABZdwA5ajdnd+m A==; X-CSE-ConnectionGUID: XfN0NTq+Rba5IqP8p74uOA== X-CSE-MsgGUID: eokJsNpXR3miSSELSyqclw== X-IPAS-Result: A0BJAgDpwNFq/5P/Ja1aglmCV3VgQ0mUKYIhA54cFIFqDwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECFhkrIwgZgwIBgjoDNwMRvHaBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIJVgWMnG4FJRIEVg2mBBYFcAgIYfy5YhgYEgxwSgVqBA0qTekiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegXImOwsHATxRASsEgRQIgS4skmeSQKEPhCiMIpU6GjOEBIFXiz2HA5JUC5YagmOOCpZPhGmBaDyBWTMaCBsVO4JnCUoZD445g2uFE1HIdicyAgkyAQEHAgcOAwuBaJAALIFSAQE IronPort-Data: A9a23:PLXmvaz2H1ccFsJyeZV6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkVUm zBLD2uCbvreN2enfY0nO4uwpEsF6JOAzdViQQBvqVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJHE4G9U+xv80O2tHq N0BEGAVMUyeoMvjldpXSsE07igiBNPgMIVavjRryivUSK9+B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPHWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeK9aIWPKoDaLSlTtkufp UDd2XzJOEofNeek5B6+42ungvCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul7fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:zT6E6KqvHcEdSS0ROI1m/DUaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:hXU5GGM7c9BLBO5DaCdBrGgoA4MfeHSA7W7oc1fnVXtOYejA X-Talos-MUID: 9a23:ZO5YzwkXv5hZif3cFHcqdnpvM8RK+IK2OHpWlJQ9gOSgDj1pMDOC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528072848" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id EA9321800027C for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 2A21FCC2EF3; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 16/27] python3-git: fix CVE-2026-76219 Date: Thu, 15 Oct 2026 23:19:11 -0700 Message-Id: <20261016061922.843414-17-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247979 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32 [2] https://www.cve.org/CVERecord?id=CVE-2026-76219 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76219.patch | 166 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 167 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch new file mode 100644 index 0000000000..0299aa026a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch @@ -0,0 +1,166 @@ +From 5e0fc3555d6e9912ea9dc152252bf252fd428185 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 09:06:40 +0000 +Subject: [PATCH 24/38] Guard read-tree index output paths + + +GHSA-4gmw-gg2m-w46p reports that caller-controlled treeish arguments could +be parsed by git read-tree as --index-output and select an arbitrary output +path. A regression test showed that from_tree reached Git instead of raising +UnsafeOptionError; the same unchecked path was reachable through reset and +both merge_tree treeish positions. + +Add the project-standard unsafe-option guard and explicit opt-out to +from_tree, merge_tree, and reset. Check positional and keyword candidates so +abbreviations and alternate forwarding forms are covered before read-tree +runs. + +A broader audit found only two read-tree sinks in the codebase; both are now +guarded, and reset delegates to the guarded from_tree path. The only remaining +index-output use is GitPython's controlled temporary index. Git cf5497b14 +confirms read-tree parses this path-taking option before tree arguments. +Focused index tests and Ruff checks pass. + +CVE: CVE-2026-76219 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 9b5dcaf85da5946dbf69dcd53f9edba08f760b32) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 52 ++++++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 44 insertions(+), 8 deletions(-) + +diff --git a/git/index/base.py b/git/index/base.py +index 687b72da..2e11f38b 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -142,6 +142,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + """ + + unsafe_git_checkout_index_options = ["--prefix"] ++ unsafe_git_read_tree_options = ["--index-output"] + + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") + +@@ -270,8 +271,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + + @post_clear_cache + @default_index +- def merge_tree(self, rhs: Treeish, base: Union[None, Treeish] = None) -> "IndexFile": +- """Merge the given rhs treeish into the current index, possibly taking ++ def merge_tree( ++ self, ++ rhs: Treeish, ++ base: Union[None, Treeish] = None, ++ allow_unsafe_options: bool = False, ++ ) -> "IndexFile": ++ """Merge the given `rhs` treeish into the current index, possibly taking + a common base treeish into account. + + As opposed to the :func:`IndexFile.from_tree` method, this allows you to use an +@@ -284,6 +290,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + Optional treeish reference pointing to the common base of 'rhs' and this + index which equals lhs. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + self (containing the merge and possibly unmerged entries in case of + conflicts) +@@ -294,6 +303,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + yourself, you have to commit the changed index (or make a valid tree from + it) and retry with a three-way index.from_tree call. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([base, rhs]), ++ unsafe_options=self.unsafe_git_read_tree_options, ++ ) ++ + # -i : ignore working tree status + # --aggressive : handle more merge cases + # -m : do an actual merge +@@ -337,8 +352,14 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + return inst + + @classmethod +- def from_tree(cls, repo: "Repo", *treeish: Treeish, **kwargs: Any) -> "IndexFile": +- """Merge the given treeish revisions into a new index which is returned. ++ def from_tree( ++ cls, ++ repo: "Repo", ++ *treeish: Treeish, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> "IndexFile": ++ R"""Merge the given treeish revisions into a new index which is returned. + The original index will remain unaltered. + + :param repo: +@@ -358,6 +379,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + :param kwargs: + Additional arguments passed to git-read-tree. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + New IndexFile instance. It will point to a temporary index location which + does not exist anymore. If you intend to write such a merged Index, supply +@@ -375,6 +399,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + if len(treeish) == 0 or len(treeish) > 3: + raise ValueError("Please specify between 1 and 3 treeish, got %i" % len(treeish)) + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates(treeish, kwargs), ++ unsafe_options=cls.unsafe_git_read_tree_options, ++ ) ++ + arg_list: List[Union[Treeish, str]] = [] + # Ignore that the working tree and index possibly are out of date. + if len(treeish) > 1: +@@ -1350,6 +1380,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + working_tree: bool = False, + paths: Union[None, Iterable[PathLike]] = None, + head: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "IndexFile": + """Reset the index to reflect the tree at the given commit. This will not +@@ -1375,6 +1406,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + The paths need to exist at the commit, otherwise an exception will be + raised. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :param kwargs: + Additional keyword arguments passed to git-reset + +@@ -1383,10 +1417,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + check out the files according to their state in the index. + If you want git-reset like behaviour, use *HEAD.reset* instead. + +- :return: self""" +- # What we actually want to do is to merge the tree into our existing +- # index, which is what git-read-tree does. +- new_inst = type(self).from_tree(self.repo, commit) ++ :return: ++ self ++ """ ++ # What we actually want to do is to merge the tree into our existing index, ++ # which is what git-read-tree does. ++ new_inst = type(self).from_tree(self.repo, commit, allow_unsafe_options=allow_unsafe_options) + if not paths: + self.entries = new_inst.entries + else: +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 37de657041..a56970cc84 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -37,6 +37,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-73619.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ + file://CVE-2026-76219.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101034 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54CB0CCF2C7 for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15899.1792131564223008482 for ; Thu, 15 Oct 2026 23:19:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Z40AE3Ut; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4974; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=jyn/KNkCJVd0aNkSFBYTyY7pjyOTuOZwma7Wme6eC3U=; b=Z40AE3UtwP9Qw3OWgGbR6hU3xoGCCXcfQxAutfrSS9Q0FyI/xIWe0N/a cO0pA4MJaxSCEdv4jfUZBoHAfQ9A17TDO9yTDGX2tcvc/6RegB8/HszHJ zQROtHZ9sJW7Ui4AJgB1thxfZem8Csi14A4HEYWlPbPXTNBZ0KzHc5bNx iLRnwNtYKxcjC1xMQrS9tCqnBdGD36TOBenNJvMpZOvNIk/gH4VBdIrAm y71/AV3lEy/Mp9YqhIevehUVVFOF6DTly8tUA/vXYP9XLbbmmfQbKhlRm q9hkfE1Izk18fSokPBDILCRfLLezJil60pYeeCN4dYx8Y94tAV4ekGKGW w==; X-CSE-ConnectionGUID: 7XJGF4/2Ry2UNV08xob0rA== X-CSE-MsgGUID: P+jApF9cSJ6u0jKUEKVZ8Q== X-IPAS-Result: A0BIAgBrwNFq/4v/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIgLBIINgQ8SgVoelSlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJjsSAR4eUQEQG4FadqVRoQ+EKIwilToaM4VbpRQLmH2OCpUzgRyEaYFoPIFEDgczGggbFYMiCUoZD445g2uFE1HIdicyAgkyAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:H6o/LKlmUYCfad4z6Vwo3bDo5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIcWW/Vb/jZZmf3fth0O4++phkHu5eByYBjTlQ9/i4xFFtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FdIo2MlZXSYUz +1CFRYzNkCTgOju2pvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYGLI43RFZgI9qqej lqF/U3hLEARD/7B1GKH0U+BpdH9zRquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjJCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:R8VqEqmTgo+r8uugn4Vt7kYCKHvpDfIA3DAbv31ZSRFFG/Fw8P re+MjzuiWbtN98YhwdcJW7Scq9qBDnhPtICPcqXItKNTOO0ADDEGgh1/qB/9SKIULDH4BmuZ uIC5IfNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:E+uP22FBGn8E0hYLqmI4xGw7NJxiKEfMlkr2HRfoGWFjEKe8HAo= X-Talos-MUID: 9a23:ilczSgjMPZjjxOtcYaHdFsMpDIRqyryAWUs2s8sb48unCAFTBQXNtWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536193855" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id ECCC318000348 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 2F9ABCBEF8B; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 17/27] python3-git: fix CVE-2026-76218 Date: Thu, 15 Oct 2026 23:19:12 -0700 Message-Id: <20261016061922.843414-18-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247974 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7 [2] https://www.cve.org/CVERecord?id=CVE-2026-76218 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76218.patch | 91 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 92 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch new file mode 100644 index 0000000000..a9de5abba2 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch @@ -0,0 +1,91 @@ +From 7c287bb0e4044b0f0fd8c6423a0b2a2cc05468e4 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 02:48:01 +0000 +Subject: [PATCH 25/38] Guard unsafe git init options + + +GHSA-9rj7-rf2p-w77r reports that Repo.init forwarded git-init +options without applying GitPython's unsafe-option policy. A regression +showed template and abbreviated option spellings reached Git without an +UnsafeOptionError and could create the destination before validation. + +Add a git-init denylist for template installation and separate Git +directory redirection, check keyword options before any path or directory +mutation, and provide the standard explicit allow_unsafe_options escape +hatch. This preserves trusted uses while rejecting untrusted forwarding by +default. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) confirmed that init and clone are the +built-in commands that consume repository template directories. Clone, +clone_from, and submodule cloning already share the guarded clone helper; +the similarly named commit option only reads a commit-message template. + +Validated with the focused init regression, the clone/init unsafe-option +suite, 185 config/Git/index/clone tests, Ruff, and basedpyright. + +CVE: CVE-2026-76218 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 7142f220..772beb75 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -133,6 +133,14 @@ class Repo: + re_author_committer_start = re.compile(r"^(author|committer)") + re_tab_full_line = re.compile(r"^\t(.*)$") + ++ unsafe_git_init_options = [ ++ # Can install hooks that execute during later Git commands: ++ "--template", ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", ++ ] ++ """Options to :manpage:`git-init(1)` that permit unsafe code execution or I/O.""" ++ + unsafe_git_clone_options = [ + # Executes arbitrary commands: + "--upload-pack", +@@ -1256,6 +1264,7 @@ class Repo: + mkdir: bool = True, + odbt: Type[GitCmdObjectDB] = GitCmdObjectDB, + expand_vars: bool = True, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "Repo": + """Initialize a git repository at the given path if specified. +@@ -1279,11 +1288,20 @@ class Repo: + can lead to information disclosure, allowing attackers to + access the contents of environment variables. + ++ :param allow_unsafe_options: ++ Allow unsafe options to be used, such as ``--template`` and ++ ``--separate-git-dir``. ++ + :param kwargs: + Keyword arguments serving as additional options to the git-init command. + + :return: ``git.Repo`` (the newly created repo) + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_init_options, ++ ) + if path: + path = expand_path(path, expand_vars) + if mkdir and path and not osp.exists(path): +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index a56970cc84..883bd418b1 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -38,6 +38,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ + file://CVE-2026-76218.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101047 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82C82CCA490 for ; Fri, 16 Oct 2026 06:19:45 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15906.1792131584148701298 for ; Thu, 15 Oct 2026 23:19:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=dbvJzrah; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8103; q=dns/txt; s=iport01; t=1792131585; x=1793341185; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+XtBit+9e0Mdqd+kNyYqhSC3p61UjvTbhAodGNE2/RQ=; b=dbvJzrahv/mhdd+LKHInA2uCnR1g+KZ1qKu6VAESEInBqKtbW0Sxo/EC cGOZC73XDE8g5dNo6PbmGmU/z40heqmoZh/SFwO1JIW+17YLmD1zFplTw 96kaksZnmjOmkQx4qcA0dz0ENBZBRYOapD9UXtGOiyAvTWRcM2PCZOfT/ cSWmdBS1sF8eCID3FqI7lUfXqUY+4w6sIlM2+ot5nhywenT0Fd9yrdlcx ethmf9s6EHDdKKZ9TmTiUDEnN5q+cyYwEfuEQEKqM5UCAuJGK0p6QKmbj UFtemzXVolSS6T6LEn8v4higezZQxXfhpBk4qcDJiZl01y3f2ql8WY0qM w==; X-CSE-ConnectionGUID: t3rL+DwdS8aAFigLTJlKiA== X-CSE-MsgGUID: ho4wr8rPSP+GOuNWIi2nug== X-IPAS-Result: A0BLAgBfwdFq/5L/Ja1aHgE8DA4LgVmCV3VgQ0kDlCaCIQOeHBSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRRrwtgXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIENIIZeBIINgQ8SgVqBA4QLkDlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJjsLBwE8Hx8TARAbgXgFAQ0mCgICEZMRA5I9oQ+EKIwilToaM4VbpRQLmH2OCpYCTYRpgWg8gUMPBzMaCBsVO4JnCUoZD16NW4NrhRNRyHYnMgIGAzIBAQcCBw4DC4FokAACJgeBTwEB IronPort-Data: A9a23:PCqFHag0dreoz6CHFGcNogY8X161NhEKZh0ujC45NGQN5FlHY01je htvWT2DOq3fMGv3e4p2YIyw8BkDu5CGy4NmTQFs/iA0RC9jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUEofxTQk1R+ cdIIRkjbx+nu8Cy47OSH7wEasQLdKEHPasFsX1miDWcBvE8TNWbEuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgl/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJIDaGJgJxi50o ErG+DjmGEEADOenihWi71STp+6Vmz70Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBVCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u7Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:QIMTT6h0gxbJT5O50Dxk5rrqFHBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:JWO8emHglyEiybTTqmJ7r1QwWew6fkaNxV7+IkCcNURta7y8HAo= X-Talos-MUID: 9a23:cDhX7w3VLi4UEEU8zXkCB21+tzUj46PyF1pdi609g4qrEjFWBBac1jKqTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536485540" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id EE69318000202 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 34EEDCC12A6; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 18/27] python3-git: fix CVE-2026-76217 Date: Thu, 15 Oct 2026 23:19:13 -0700 Message-Id: <20261016061922.843414-19-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247993 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c [2] https://www.cve.org/CVERecord?id=CVE-2026-76217 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-76217.patch | 173 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 174 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch new file mode 100644 index 0000000000..22331a51c2 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch @@ -0,0 +1,173 @@ +From 77915268777d0928ea156f00c95fa77c6f8294bb Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 03:18:54 +0000 +Subject: [PATCH 26/38] Guard pathspec file inputs in high-level commands + + +GHSA-hh9p-6wh2-4mfc reports that high-level rm and checkout wrappers +forwarded pathspec file options without GitPython's unsafe-option policy. +A regression showed that both commands surfaced multi-line pathspec data in +Git errors, while reset consumed the same caller-selected file without a +validation error. The audit also found that reset's positional commit could +carry the option before its argument separator. + +Define one shared unsafe pathspec-file option list and apply it to +IndexFile.remove, Head.checkout, and HEAD.reset before invoking Git. Check +reset's positional commit as well as keyword options, retain the standard +allow_unsafe_options escape hatch for trusted callers, and cover abbreviated +long-option spellings. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) found pathspec-file support in add, +checkout/restore, commit, reset, rm, and stash. GitPython has no arbitrary +high-level option forwarding to the other commands, and git mv does not +support this option. + +Validated with focused rejection and opt-in tests, 214 affected-module +regressions, Ruff, basedpyright, and git diff --check. + +CVE: CVE-2026-76217 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit f2550b65bf60ca087190981e2c7b6865e201f40c) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 6 ++++++ + git/index/base.py | 10 ++++++++++ + git/refs/head.py | 27 ++++++++++++++++++++++++++- + 3 files changed, 42 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index b1aef9d3..398c68ff 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -333,2 +333,8 @@ ++ unsafe_git_pathspec_from_file_options = [ ++ # Reads pathspecs from a caller-controlled file. Some commands include an ++ # unmatched pathspec in their error output, which can disclose the file. ++ "--pathspec-from-file", ++ ] ++ + def __getstate__(self) -> Dict[str, Any]: + return slots_to_dict(self, exclude=self._excluded_) +diff --git a/git/index/base.py b/git/index/base.py +index 2e11f38b..a92ba82b 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -986,6 +986,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + self, + items: Sequence[Union[PathLike, Blob, BaseIndexEntry, "Submodule"]], + working_tree: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[str]: + """Remove the given items from the index and optionally from +@@ -1014,6 +1015,10 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + removing the respective file. This may fail if there are uncommitted changes + in it. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-rm(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to git-rm, such + as 'r' to allow recursive removal of +@@ -1024,6 +1029,11 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + This is interesting to know in case you have provided a directory or + globs. Paths are relative to the repository. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + args = [] + if not working_tree: + args.append("--cached") +diff --git a/git/refs/head.py b/git/refs/head.py +index ebc71eb9..5900d3c6 100644 +--- a/git/refs/head.py ++++ b/git/refs/head.py +@@ -17,6 +17,7 @@ from .reference import Reference + + from typing import Any, Sequence, Union, TYPE_CHECKING + ++from git.cmd import Git + from git.types import PathLike, Commit_ish + + if TYPE_CHECKING: +@@ -63,6 +64,7 @@ class HEAD(SymbolicReference): + index: bool = True, + working_tree: bool = False, + paths: Union[PathLike, Sequence[PathLike], None] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "HEAD": + """Reset our HEAD to the given commit optionally synchronizing +@@ -86,11 +88,20 @@ class HEAD(SymbolicReference): + Single path or list of paths relative to the git root directory + that are to be reset. This allows to partially reset individual files. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-reset(1)`. ++ + :param kwargs: + Additional arguments passed to git-reset. + + :return: self + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([commit], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + mode: Union[str, None] + mode = "--soft" + if index: +@@ -230,7 +241,12 @@ class Head(Reference): + self.path = "%s/%s" % (self._common_path_default, new_path) + return self + +- def checkout(self, force: bool = False, **kwargs: Any) -> Union["HEAD", "Head"]: ++ def checkout( ++ self, ++ force: bool = False, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union["HEAD", "Head"]: + """Check out this head by setting the HEAD to this reference, by updating the + index to reflect the tree we point to and by updating the working tree to + reflect the latest index. +@@ -242,6 +258,10 @@ class Head(Reference): + If False, :class:`~git.exc.GitCommandError` will be raised in that + situation. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-checkout(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to git checkout, e.g. + ``b="new_branch"`` to create a new branch at the given spot. +@@ -257,6 +277,11 @@ class Head(Reference): + will leave the HEAD detached which is allowed and possible, but remains + a special state that some tools might not be able to handle. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + kwargs["f"] = force + if kwargs["f"] is False: + kwargs.pop("f") +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 883bd418b1..d634239cdb 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -39,6 +39,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ + file://CVE-2026-76217.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101037 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9FBFCCF2CA for ; Fri, 16 Oct 2026 06:19:34 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15614.1792131565447869150 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=U0/h6jk2; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10927; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=/EMs+dqU/a7vzaXvx+ghWY3EFFrORw/NlTsWuC1UbJ8=; b=U0/h6jk2BISLtQd4XDen56MkKu/IHrBAEg+pozVKHJ+KKK8turFcPrvg HTj1e6BrDnwAq7JpyAHiV3/q4+tl+Q0BMI3g3tUoTMFd5TQpqdhkpFKAl V3HXKaWqi4YpCovg1nRyVNzkxPSS2FWFLVSdhm1TTpzZvcgG++aNfzmzf xpMFK3ukdht5JYFeMB+P9iWD6VGSedahU5wcDVPWTBT9X6a4uPrCO49ww rL1NH1yqGhT5GRjHcmoYuq0fOEiD1MY72n8qLzo0+/SojSVF46FizwuKh G+78ArczqgxPXbJ1MeGRGxsDg3QC7CSpyLuECYaFtkrINe03YQCISzyPp A==; X-CSE-ConnectionGUID: 6e+muBu0RYi26V34w9BrRg== X-CSE-MsgGUID: Ab+SqDnASmSfxzhQIykWaw== X-IPAS-Result: A0BJAgDpwNFq/5T/Ja1aH4I6gld1YENJlCmCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEglWBYycbgUlEgRWDaYEFgVwBAYEnhn4EgxwSgVp+aIZTjQ5IgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYTVgcBxMBByQXP4EnUxYUkAuCXAEBkB2CIaEPhCiMIpU6GjOEBIFXkkCSVAuYfY4KlTM0aIRpgWg8gUcLBzMaCBsVgyIJShkPjjmDa4F/glGBFMh2JzICCTIBAQcCBw4DC4FokAACJgeBTwEB IronPort-Data: A9a23:oQHOKa54xlYJFyUbgkQwNgxRtG/GchMFZxGqfqrLsTDasY5as4F+v jYWD2zQaKyMNGagf9wgPdi/pEoPvJPRn9JgSwduq3w0Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eY4Bb//tdHDl0x P1Cdg5WMg/SrfiMz+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGMmFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEfUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwaoCNI4PTGZQ9ckCwj 2iFxH3VBDghMeeR2SiFy1O9hdDGgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPAXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:uH2m9Kru0AHp3RxufxqaaBcaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:9AMZJWsExB8aF5otTMRz4Ede6It7fz7Y0V3Ne3WJCDw3dubJVg664plrxp8= X-Talos-MUID: 9a23:1Hgk/wQLWvSRKtODRXTFjnJZLetuyp+rM04dg5U/mtiHCiVvbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522017149" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id F18C118000140 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 3AB75CBEFAA; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 19/27] python3-git: fix CVE-2026-76222 Date: Thu, 15 Oct 2026 23:19:14 -0700 Message-Id: <20261016061922.843414-20-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247988 This patch applies the upstream fix as referenced in [4], using the commit shown in [1], regression fix in [2] and follow-up fix in [3]. [1] https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06 [2] https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd [3] https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c [4] https://nvd.nist.gov/vuln/detail/CVE-2026-76222 Signed-off-by: Yogita Urade --- .../CVE-2026-76222-regression.patch | 35 +++++ .../python3-git/CVE-2026-76222_p1.patch | 123 ++++++++++++++++++ .../python3-git/CVE-2026-76222_p2.patch | 49 +++++++ .../python/python3-git_3.1.42.bb | 3 + 4 files changed, 210 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch new file mode 100644 index 0000000000..725403d1bb --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch @@ -0,0 +1,35 @@ +From a82b22c137622eb76112d5ec04e86b246e57eab3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 11:07:02 +0200 +Subject: [PATCH] Initialize submodule repository before handled failures + +Direct recursive updates with keep_going could swallow an invalid-name +validation error and then access mrepo before assignment. Initialize +mrepo before validation so recursion is safely skipped. + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd] + +Backport Changes: +- Omitted `test/test_submodule.py` because the PyPI source archive omits + tests, which are outside this recipe's test surface. +- Omitted `.basedpyright/baseline.json` because it is development-only + static-analysis metadata absent from the source archive. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b324c831cbc02c82b99c18113b622d03539d23cd) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index ec0a534f..45fc4551 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -640,3 +640 @@ class Submodule(IndexObject, TraversableIterableObj): +- # To keep things plausible in dry-run mode. +- if dry_run: +- mrepo = None ++ mrepo = None diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch new file mode 100644 index 0000000000..77e47a8497 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch @@ -0,0 +1,123 @@ +From 190b90a1932cb548b0b95f5c2751377012c37d42 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sat, 1 Aug 2026 04:47:40 +0200 +Subject: [PATCH 27/38] Validate submodule names before filesystem operations + + +Submodule names read from .gitmodules can influence the separate Git directory +path. Reject empty names, absolute or drive-qualified names, and parent +components with either path separator. + +Validate before constructing module paths and before opening or mutating +existing checkouts, so a repository initialized by an older vulnerable version +cannot bypass the guard. Validate programmatic add and rename inputs before +making changes as well. + +Advisory: GHSA-hmq2-w58f-27jc + + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06] + +Backport Changes: +- Omit upstream regression test changes because the Scarthgap PyPI source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit e4b8e7d026ca6abb4cf604f8e77093432ce23c06) +Signed-off-by: Yogita Urade + +--- + git/objects/submodule/base.py | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 4fe2ff3f..84d6bcdc 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -4,6 +4,7 @@ + import gc + from io import BytesIO + import logging ++import ntpath + import os + import os.path as osp + import stat +@@ -267,10 +268,21 @@ class Submodule(IndexObject, TraversableIterableObj): + parser.set_submodule(self) + return SectionConstraint(parser, sm_section(self.name)) + ++ @classmethod ++ def _validated_name(cls, name: str) -> str: ++ if ( ++ not name ++ or name.startswith(("/", "\\")) ++ or ntpath.splitdrive(name)[0] ++ or ".." in name.replace("\\", "/").split("/") ++ ): ++ raise ValueError("Invalid submodule name %r" % name) ++ return name ++ + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", name) ++ return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() +@@ -430,6 +442,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise InvalidGitRepositoryError("Cannot add submodules to bare repositories") + # END handle bare repos + ++ cls._validated_name(name) + path = cls._to_relative_path(repo, path) + + # Ensure we never put backslashes into the URL, as some operating systems +@@ -629,6 +642,8 @@ class Submodule(IndexObject, TraversableIterableObj): + # END init mrepo + + try: ++ self._validated_name(self.name) ++ + # ENSURE REPO IS PRESENT AND UP-TO-DATE + ####################################### + try: +@@ -880,6 +895,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("You must specify to move at least the module or the configuration of the submodule") + # END handle input + ++ self._validated_name(self.name) + module_checkout_path = self._to_relative_path(self.repo, module_path) + + # VERIFY DESTINATION +@@ -1002,6 +1018,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Need to specify to delete at least the module, or the configuration") + # END handle parameters + ++ self._validated_name(self.name) + # Recursively remove children of this submodule. + nc = 0 + for csm in self.children(): +@@ -1211,6 +1228,9 @@ class Submodule(IndexObject, TraversableIterableObj): + if self.name == new_name: + return self + ++ self._validated_name(self.name) ++ self._validated_name(new_name) ++ + # .git/config + with self.repo.config_writer() as pw: + # As we ourselves didn't write anything about submodules into the parent .git/config, +@@ -1254,6 +1274,7 @@ class Submodule(IndexObject, TraversableIterableObj): + :raise InvalidGitRepositoryError: If a repository was not available. This could + also mean that it was not yet initialized. + """ ++ self._validated_name(self.name) + module_checkout_abspath = self.abspath + try: + repo = git.Repo(module_checkout_abspath) +-- +2.35.6 +(cherry picked from commit e4b8e7d026ca6abb4cf604f8e77093432ce23c06) +Signed-off-by: Yogita Urade diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch new file mode 100644 index 0000000000..5f549b0e35 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch @@ -0,0 +1,49 @@ +From df2835724f8f92bc0a9efed691e14c8bdf58a6dc Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 10:08:41 +0200 +Subject: [PATCH 28/38] Validate submodule names on every module path branch + + +_module_abspath only validated names when Git used separate gitfile +submodule directories, so legacy Git behavior could accept the same invalid +name. Validate before selecting the Git-version-dependent path branch and +cover the legacy branch explicitly. + +Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a +validates submodule paths before filesystem operations. + + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c] + +Backport Changes: +- Omit upstream regression test changes because the Scarthgap PyPI source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4299c990e1ca21896f9485277caf7bb0ae5b404c) +Signed-off-by: Yogita Urade + +--- + git/objects/submodule/base.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 84d6bcdc..09a784e1 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -281,8 +281,9 @@ class Submodule(IndexObject, TraversableIterableObj): + + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: ++ name = cls._validated_name(name) + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) ++ return osp.join(parent_repo.git_dir, "modules", name) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() +-- +2.35.6 +(cherry picked from commit 4299c990e1ca21896f9485277caf7bb0ae5b404c) +Signed-off-by: Yogita Urade diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index d634239cdb..4375809d3a 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -40,6 +40,9 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ file://CVE-2026-76217.patch \ + file://CVE-2026-76222_p1.patch \ + file://CVE-2026-76222-regression.patch \ + file://CVE-2026-76222_p2.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101025 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75BD4CCA490 for ; Fri, 16 Oct 2026 06:19:32 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15902.1792131565169883842 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=QeX7OVWz; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9672; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=T6wTTNgJGpfYxiJ5990yHwzMFY3KOZ2dkM+tpQC2+AM=; b=QeX7OVWzxNxkuNfVJez7ypP5Xu5veX2jLnhDhCc+WvTMeQuGCBL/7h36 9QsiWOKcEtTxEHYu5Tm+vYGVU7v44YOP+4IxkioRF/ittO8Y7PIOxU6Bz MSitvHN+8PTYhn/K+pcdvvJ3ZhR/y+HGh4vyhiFJ6JDevhz3s8KbJbyXF yvt6A+ry3U2eOeBlp1nEPsW3zNjss3WUnfRlBlxK0xn1tDLy331Nljgmq 3I/g6/dcF7Eu7xC/hplppJeTxkIPMCPs96vuKfd3GiaQxaIGV1eHByTFT H5KHwwyD+oMDikW7PJy+EgIyiw6ceRs5v9X4fNZUnKbIZ3RI82Ml7VbkN A==; X-CSE-ConnectionGUID: MlisZDlmSsWOoWGC+PaUDQ== X-CSE-MsgGUID: MF0WaTDIRtyMmtrA9bD1rA== X-IPAS-Result: A0BJAgDpwNFq/5L/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAFEglWBYycbgUlEgRWDaYEFgVwBAYglBIINgQ8SgVqBA45KhXpIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJgglDhItECYrASsEgkQypSefUYE+hCiMIpU6GjOEBIFXkkCSVAuYfY4KlTpITYRpgWg8gUcLBzMaCBsVO4JnCUoZD44rDguDYIF/g2XIdicyAgYDMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:TkAt+6Cr6aUGDhVW/37iw5YqxClBgxIJ4kV8jS/XYbTApGgm0DUFy GoaDD2Abv/ZZDDwKt9/YIy2oUIF7ZPXn4BjOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf8hWYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE5vFvF3MaOYgj4dlQBl5h3 r8gIQ0hV0XW7w626OrTpuhEnM8vKozveYgYoHwllWCfBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYxBPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOl1IuiuKya4S9ltqiYOsNoU+ki kP843XcBw0AHY2V5WOf2yf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTVm+zf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ12FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:NYxqeaivnJej59M43O7yrmVwVnBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:mVIkq278t4C5dSsV/9ss0UoVAfIJdnjm10j3JHCXIiVRQYC5cArF X-Talos-MUID: 9a23:PP8fggYUyQ33xeBTkhG0uzheGOZS/7WLDVwXuMQMl5CeHHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722736" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 0068618000586 for ; Fri, 16 Oct 2026 06:19:23 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 400B1CC12A7; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679 Date: Thu, 15 Oct 2026 23:19:15 -0700 Message-Id: <20261016061922.843414-21-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247987 This patch applies the upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78678 [3] https://nvd.nist.gov/vuln/detail/cve-2026-78679 Signed-off-by: Yogita Urade --- .../CVE-2026-78678_CVE-2026-78679.patch | 208 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 209 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch new file mode 100644 index 0000000000..6277a9e509 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch @@ -0,0 +1,208 @@ +From 51216053bd6885b546be8e9ed2e8e1000e7ee5a3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Wed, 5 Aug 2026 04:48:36 +0200 +Subject: [PATCH] Block file-reading Git options + + +Reject file-reading options passed to blame, diff, and tag APIs. Inspect +positional values after resolving aliases, recognize unsafe options +behind command-specific short-flag clusters, and retain the explicit +allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and +GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink. + +Regression tests cover long, short, and clustered options, incremental blame, +tag path/reference positionals, the ref keyword alias, both diff entry points, +and preservation of diff pickaxe behavior. + +Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options. + +CVE: CVE-2026-78678 CVE-2026-78679 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +(cherry picked from commit 1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 8 +++++--- + git/diff.py | 7 ++++--- + git/index/base.py | 3 ++- + git/repo/base.py | 27 +++++++++++++++++++++------ + git/refs/tag.py | 10 ++++++---- + 5 files changed, 39 insertions(+), 16 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 1b1da383..a91f8a0f 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -571,7 +571,9 @@ class Git(LazyMixin): + return dashify(option_tokens[0]) + + @classmethod +- def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: ++ def check_unsafe_options( ++ cls, options: List[str], unsafe_options: List[str], clusterable_short_options: str = "46flnqsv" ++ ) -> None: + """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. + + In addition to exact matches, this rejects abbreviated long options accepted +@@ -606,7 +608,7 @@ class Git(LazyMixin): + # These value-less Git flags can be clustered before another short option + # (for example, ``-fuVALUE``). Stop at any other character because it may + # begin an attached value, as ``o`` does in the safe option ``-oupstream``. +- clusterable_short_options = frozenset("46flnqsv") ++ clusterable_short_options_set = frozenset(clusterable_short_options) + options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) +@@ -623,7 +625,7 @@ class Git(LazyMixin): + raise UnsafeOptionError( + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) +- if option_char not in clusterable_short_options: ++ if option_char not in clusterable_short_options_set: + break + if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): + continue +diff --git a/git/diff.py b/git/diff.py +index 37ff2624..84e7687b 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -136,8 +136,8 @@ class Diffable: + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` that can write to arbitrary +- filesystem paths. ++ If ``True``, allow options such as ``--output`` and ``-O`` that can write to ++ or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to git-diff, such as ``R=True`` to swap both +@@ -153,7 +153,8 @@ class Diffable: + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + args: List[Union[PathLike, Diffable]] = [] +diff --git a/git/index/base.py b/git/index/base.py +index a92ba82b..520c703c 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -1485,7 +1485,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + # Only run if we are the default repository index. +diff --git a/git/repo/base.py b/git/repo/base.py +index 9011b0a4..ebad63b8 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -187,6 +187,19 @@ class Repo: + "-o", + ] + ++ unsafe_git_blame_options = unsafe_git_revision_options + [ ++ # These options read arbitrary files and expose their contents through blame output. ++ "--contents", ++ "-S", ++ "--ignore-revs-file", ++ ] ++ ++ unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Reads caller-controlled order patterns from an arbitrary file. ++ "-O", ++ "--orderfile", ++ ] ++ + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") + """Represents the configuration level of a configuration file.""" +@@ -755,7 +768,8 @@ class Repo: + + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ options=Git._option_candidates([rev], kwargs), ++ unsafe_options=self.unsafe_git_revision_options + ) + + return Commit.iter_items( +@@ -1019,7 +1033,7 @@ class Repo: + :param rev: Revision specifier, see git-rev-parse for viable options. + + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + :return: + Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the +@@ -1031,7 +1045,9 @@ class Repo: + """ + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ options=Git._option_candidates([rev], kwargs), ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) +@@ -1118,7 +1134,7 @@ class Repo: + :param rev: Revision specifier, see git-rev-parse for viable options. + + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + :return: + list: [git.Commit, list: []] +@@ -1133,7 +1149,8 @@ class Repo: + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([rev, rev_opts_list], kwargs), +- unsafe_options=self.unsafe_git_revision_options, ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} +diff --git a/git/refs/tag.py b/git/refs/tag.py +index 640e9702..15da4c6d 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -120,15 +120,17 @@ class TagReference(Reference): + + :return: A new TagReference. + """ ++ legacy_ref = kwargs.pop("ref", None) ++ if legacy_ref: ++ reference = legacy_ref ++ + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([], kwargs), ++ options=Git._option_candidates([path, reference], kwargs), + unsafe_options=cls.unsafe_git_tag_options, ++ clusterable_short_options="46adefilnqsv", + ) + +- if "ref" in kwargs and kwargs["ref"]: +- reference = kwargs["ref"] +- + if "message" in kwargs and kwargs["message"]: + kwargs["m"] = kwargs["message"] + del kwargs["message"] +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 4375809d3a..a77fddda5b 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -43,6 +43,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76222_p1.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ + file://CVE-2026-78678_CVE-2026-78679.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101023 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88DF4CCA46D for ; Fri, 16 Oct 2026 06:19:33 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15612.1792131564472441473 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=EnBwPg7t; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5031; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=MV6caU4mTrKZxQ+vrq0R3Sn9HTMImVZfB2eZqZav66E=; b=EnBwPg7twRNiM4cbivMH4eQ58A4/NXWZDD4o3SrM81X/SqfYoP/Slbzy 4xRR8eNcow7UuWcYUufPd6RZUTC2ktwOIMUfT7YykTzufqOtxsdMZ10Iv opa/JdP6RUsN4Y4NLKDR6oCtYJc7nwnEofFWIq+CU6b5S6DE1mEL218rp zJuyFGnHOLAmMvmM5hG7uhVIYnWpbCqUXxPCbfT7vTBwbs/F5yUiKpxQT i3PV6kEXr8r8FliFvySn2hFvCfUKqdbn7d2HW+Qko/lplS7kIejn/zRWU ihT1p0i/X6Q+4og9dwIkQnNdY7wghH0bp41BDmg/P/HVyAQ0Qhjo/K1wt g==; X-CSE-ConnectionGUID: FwK6vjrzRheDG+72/ycvZw== X-CSE-MsgGUID: u6gGlXleQ7uYYKI/zL/GnA== X-IPAS-Result: A0BJAgBrwNFq/4//Ja1aH4I6gld1YENJlCmCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8doF5M4EBgykBPwJDUNhLEG+BaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWDaYEFgVwCAhiBDYZ+BIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJi0OEi8OUQErVkWUP0KPZIIhgTWfWoQojCKVOhozhASBV6UUC5h9glmLMZZPhGmBaDyBWTMaCBsVgyIJShkPji4LC4NghRNRyHYnMgIJMgEBBwIHDgMLgWiQAAImB4FPAQE IronPort-Data: A9a23:9kDW4KLP2Gn7HFLSFE+RhpQlxSXFcZb7ZxGr2PjKsXjdYENShjwCy WIfWziCaa3bamD8Kt12PN609h4C68PUzNVmTFEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1AE2JoI48C6Nx3DE1ht qNCbyEGcCKc0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBU7AtQIvIROPB4towMDUY358VW62BI ZBENHw2ME+ojx5nYj/7DLovgf2hinTXeDxDo1XTrq0yi4TW5FEqjeO2bIOFKrRmQ+1IwEm3o lLC8l2mHyArF/3Y2x7C3XSF07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KKpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOH9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:RrMs+aEDOrxzb2eRpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:V+24gGnwI0ISzCT91Afne8SvdtjXOVPC7ynOIVWqM2ZkZJLWFgXX6ah6odU7zg== X-Talos-MUID: 9a23:wUSQ8g+lFh9C6alGFHk5y4GQf9o27IuqOEQAqMobivinFGtiH3Cyih3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535334188" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 027CC180004B2 for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 45975CBEFBF; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 21/27] python3-git: fix CVE-2026-78677 Date: Thu, 15 Oct 2026 23:19:16 -0700 Message-Id: <20261016061922.843414-22-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247983 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d [2] https://www.cve.org/CVERecord?id=CVE-2026-78677 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78677.patch | 87 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 88 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch new file mode 100644 index 0000000000..23e0fc931a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch @@ -0,0 +1,87 @@ +From 2e39328f9df501adf6656ced51bda466dd164bfe Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 11:20:03 +0200 +Subject: [PATCH 29/38] Block separate git directories during clone + + +Repo.clone() and Repo.clone_from() did not reject the clone option that +redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc). +Regression coverage exercises both keyword and multi-option input through both +public clone APIs. + +Add the option to the existing clone denylist, matching Repo.init() +and the documented allow_unsafe_options contract. Git itself registers + +The Python package and Alpine test workflows failed across the submodule suite +because GitPython internally supplies --separate-git-dir when creating modern +submodule layouts. The new public clone guard correctly rejected that option, +but could not distinguish the library-generated path from caller input. + +Validate caller-provided keyword and multi-options before adding the +library-controlled metadata path, then explicitly allow the resulting trusted +clone invocation. This preserves rejection of unsafe clone_multi_options while +restoring normal submodule creation. Update the one test that intentionally +invokes Repo.clone_from() with its own separate git directory to opt in +explicitly. + +CVE: CVE-2026-78677 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b68afff45af0f49e79a3e2d2162018986b37ad5d) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 10 ++++++++++ + git/repo/base.py | 4 +++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 09a784e1..4f2315fa 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -7,6 +7,7 @@ import logging + import ntpath + import os + import os.path as osp ++import shlex + import stat + import uuid + +@@ -312,6 +313,15 @@ class Submodule(IndexObject, TraversableIterableObj): + module_abspath = cls._module_abspath(repo, path, name) + module_checkout_path = module_abspath + if cls._need_gitfile_submodules(repo.git): ++ if not allow_unsafe_options: ++ Git.check_unsafe_options(Git._option_candidates([], kwargs), repo.unsafe_git_clone_options) ++ multi_options = kwargs.get("multi_options") ++ if multi_options: ++ Git.check_unsafe_options( ++ shlex.split(" ".join(cast("Sequence[str]", multi_options))), ++ repo.unsafe_git_clone_options, ++ ) ++ allow_unsafe_options = True + kwargs["separate_git_dir"] = module_abspath + module_abspath_dir = osp.dirname(module_abspath) + if not osp.isdir(module_abspath_dir): +diff --git a/git/repo/base.py b/git/repo/base.py +index 772beb75..9011b0a4 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -150,7 +150,9 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", +- # Fetches from a caller-controlled URL: ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", ++ # Fetches from an additional caller-controlled URI: + "--bundle-uri", + ] + """Options to ``git clone`` that allow arbitrary commands to be executed. +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index a77fddda5b..56d55b14c4 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -44,6 +44,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ + file://CVE-2026-78677.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101026 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96D54CCA491 for ; Fri, 16 Oct 2026 06:19:33 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15610.1792131564069746027 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Lw4qYCMN; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3781; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=0naZzD3bcH4rYcSwc0NBegEeVEYGvILAJ2kFWfJ66ZE=; b=Lw4qYCMNlYKHMtFWJP/jrSEaimQJzXwi3qso3zfnXx9RetPmkSAd8Oei CicgRAz2Ras9bm3xDMY0m+gx57MnEEND7l7XGCDZNi8zunhfRZNpT09Rq o7BxQ5CaLAHXv27tOPJRQA2jzOr735EDb881549u1bJ6t6sMoNFpKx5CX W+2Tz+crWhIjdgJjxZTrA7Ds20DhY75KAB5vw4iIp3Od5AVNXyExDdv+J 0nWzWw5Vw7QzK4w9vmvub+odfyoev904M6LxM/TL+duHAHETHebPhy0Bc 7Crdp+yRYohzoWDZTMUSgyryrYMT5TLSDX5z5ewVBMGAVZHB23iyhUZoi w==; X-CSE-ConnectionGUID: qxKWhZuMSRalOxf18Hyy/Q== X-CSE-MsgGUID: FtCTsLzySoKgIl1ChGlgHQ== X-IPAS-Result: A0BIAgDpwNFq/5L/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbx2gXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIENhn4EgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhMAS0QUQErgk4spSehD4QojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:0cVENq/luXwVHMfSNjpcDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3n WtKC2qCO/6PYTHzKYx2PIjg900F7JKEydY3GwtspHpEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kvLa4n+tRqJFp0/ Pg/OD5UPjCSlqWPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+ENbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Mn1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2boWPIIPRFa25mG62u kn65EDrEyodF9O+zWOu8l2oic/2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7IQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSn1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:pQVTfKs7GI6+frxLXpbn3PHH7skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:XEUoG2BDk9G+SN76EzB313EUKN0ASUfUyFDALRboKXd4D4TAHA== X-Talos-MUID: 9a23:ebePogbevjTDeOBTmSPHuCpGJtZT5IehKURUupUpv8akDHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536722738" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 076C6180005A6 for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 4B400CC12A9; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 22/27] python3-git: fix CVE-2026-78676 Date: Thu, 15 Oct 2026 23:19:17 -0700 Message-Id: <20261016061922.843414-23-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247985 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb [2] https://www.cve.org/CVERecord?id=CVE-2026-78676 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78676.patch | 55 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 56 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch new file mode 100644 index 0000000000..7547158173 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch @@ -0,0 +1,55 @@ +From 414dab405a73c62e70306afc79de3529a1f2a4d0 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:22:31 +0200 +Subject: [PATCH 30/38] fix: preserve multiline config values when writing + + +GitConfigParser decoded valid multiline values into embedded newlines, but +_write() serialized those newlines as indented physical lines. Rewriting an +otherwise unchanged config could therefore change its meaning to Git. + +Serialize resident multiline values with Git-compatible escapes inside a +quoted continuation, preserving GitPython read compatibility while keeping +each option structurally intact. This addresses GHSA-284h-m62q-gf8w. + +The regression starts with an inert multiline value, performs an unrelated +write, and verifies with both GitPython and git config that it remains one +value and does not create another option. + +Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape +embedded LF as \\n rather than emitting it as a physical config line. + +CVE: CVE-2026-78676 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4b4e47fc1224e23b0c8ee7220a7192818f2e4abb) +Signed-off-by: Yogita Urade +--- + git/config.py | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index ff88bd18..cc7091dd 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -665,7 +665,11 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + continue + + for v in values: +- fp.write(("\t%s = %s\n" % (key, self._value_to_string(v).replace("\n", "\n\t"))).encode(defenc)) ++ value = self._value_to_string(v) ++ if any(char in value for char in '\n\t\b\\"'): ++ value = value.replace("\\", "\\\\").replace('"', '\\"') ++ value = '"%s\\\n"' % value.replace("\n", "\\n").replace("\t", "\\t").replace("\b", "\\b") ++ fp.write(("\t%s = %s\n" % (key, value)).encode(defenc)) + # END if key is not __name__ + + # END section writing +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 56d55b14c4..813dd5a3f3 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -45,6 +45,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ + file://CVE-2026-78676.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101022 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A805CCA462 for ; Fri, 16 Oct 2026 06:19:32 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15615.1792131565476857463 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Vnqqn25J; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3528; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=LRkueFuBByVm71qEt6/92Vl7wGew0PfM70aJXfeX8vE=; b=Vnqqn25Jf94VSmSJBY2ijKVz/XMOvXtJx9Fa6RT4WX4UBb7wFhIRcRe6 Mj5LHzFRZ0G5A2sAWVvbWVlnjYMUtkYB+lof60w0S5c7segnFmvcd42+E AgIQk7lkAXShdaVQMnC5WFUKeU7J1En03q1nkU4MHM4MasSpa11F8k5/D fJaFvEafwowPOYLLfhckrM3+pnvvuxq0xMMkCS398sTfJvL6zDPD17EX1 zfjrPCudUNrBjkvFoB+j7tS4h/vjGrf+Gf08zeXxOhUn7G7YLCCLfw0+U UbBJB+KV2O/b5axuBOmmHSoOolAZB1DioQYYL1bBUiztwQ/vA49eSV+zS g==; X-CSE-ConnectionGUID: OKO/v37jR7qznwkYymLpVA== X-CSE-MsgGUID: rWR+4jUeSiytZ5F7oi3oJQ== X-IPAS-Result: A0BIAgBfwdFq/4//Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxzgXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIENhn4EgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhNPRw1ASsEgQ2BaZJnkkChD4QojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUch2JzICCTIBAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:wqqpSag6mBl595K1q3lyjpz8X161NxEKZh0ujC45NGQN5FlHY01je htvWWCOa/qIMDf1Kt10aIi+ox8HvMXRzYdiQApl+HgzQiJjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU/2cEwHzoR9 8ZHMSILcROylueS2IySH7wEasQLdKEHPasFsX1miDWcBvE8TNWbHePB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgx/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJIbWHJ4Pxi50o ErcwF66XhMnOeee2Ca3r1zzge6UmgHCDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBaCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u38Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:9UNTJ60UM+rRXQL0F3PZrAqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:1n4M1W+ND1PLNIyJ4n6Vv2k3PYc7KSLf9ijJMUmnCld4TZmNd3bFrQ== X-Talos-MUID: 9a23:NGzSqwiseQNaKVGox1PPsMMpLvhSoPisNU02kIQaiZSqaitxYDC/tWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536241320" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 0BBD418000C07 for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 50D2FCC12A8; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 23/27] python3-git: fix CVE-2026-78675 Date: Thu, 15 Oct 2026 23:19:18 -0700 Message-Id: <20261016061922.843414-24-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247990 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c [2] https://www.cve.org/CVERecord?id=CVE-2026-78675 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-78675.patch | 49 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch new file mode 100644 index 0000000000..89616c8575 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch @@ -0,0 +1,49 @@ +From f65d897b463910ef494e480fc28d9fb8c856dfa1 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:32:24 +0200 +Subject: [PATCH 31/38] fix: ignore includes in submodule configuration + + +Submodule configuration is read from .gitmodules, whose contents may come +from an untrusted repository. Its parser inherited merge_includes=True and +could therefore open files named by include directives during ordinary +submodule enumeration. + +Disable include merging at the SubmoduleConfigParser construction site. This +matches Repo.config_writer() hardening from 41ecc6a4 and addresses +GHSA-7833-fr7j-v32q without changing include behavior for trusted config +parsers. + +The regression points .gitmodules at a non-config file and verifies the +submodule entry remains readable without opening the included path. + +CVE: CVE-2026-78675 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit ef7568e3b317ce617eacda39b8b54dcdff8c3b5c) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 4f2315fa..b0c660fb 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -239,7 +239,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Cannot write blobs of 'historical' submodule configurations") + # END handle writes of historical submodules + +- return SubmoduleConfigParser(fp_module, read_only=read_only) ++ return SubmoduleConfigParser(fp_module, read_only=read_only, merge_includes=False) + + def _clear_cache(self) -> None: + """Clear the possibly changed values.""" +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 813dd5a3f3..54bc423fa6 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -46,6 +46,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ + file://CVE-2026-78675.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101027 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 471B8CC6B38 for ; Fri, 16 Oct 2026 06:19:32 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15900.1792131564578225035 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hc8SeDHI; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=18386; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=VtZCo/ZRyfc8fUPzjExkLVlnUrGezvh2SuzzAgOtt5I=; b=hc8SeDHIIDKmod4GbwDFhKwg/elPPKyS0ZRFqQankPGzZHcKWQaOb5z/ uLQ+vt2jtkeQe5VexFrfuXE/mkNaAmCiog4bdK5mB1IarAmCnwFW+9NmK VZAMDBY5g2lvO5ihAugJH+wHJ8aNN+oAn84cE750R5PrB+1BmaV6UVfZb UdVGrZcUKRJylek0TYjVD5+2u0+AYSkCuZS1T0ehhAK5xlpTmMdVqzU2y evK1r5jOVeh0dkaXR9K3MMc8cY3WDY5b3D0/yT2TrfW/gK0b+evsV3ENM 6okqHTFGcclvSrjY45VOdK/cKsShtUIs1Y3vfxnnr9awbi0ZvetXQM6Cw A==; X-CSE-ConnectionGUID: vW9yvto+TtazkxjCMWXzBQ== X-CSE-MsgGUID: 23tsyBpxTty1eraI1oX+sQ== X-IPAS-Result: A0BNAgDpwNFq/5H/Ja1aHgE8DA4LgVmCV3VgQ0mUKYIhA5FKgVSKfhSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rHQEFCBkegmQBgjoDNwMRvHaBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIQ4JxuBSUSBFYE7gi6BBYFcAgIYgSwEhlsEgxwSgVqBA5RESIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CGDsLBwE8GzYBKxd6BwMFLRgTBQsDCB4MEZMTAQEBB5I2oQ+EKIwihyeOExozhASBV5JAklQLmH2OCpUzMAQLEE2EaYFoPIFDDwczGggbFTuCZwlKGQ+OKw4Lg2CFE1HIdicyAgkyAQEHAgcOAwuBaJABASYHgU8BAQ IronPort-Data: A9a23:1StP56OWEuayOlLvrR3ylsFynXyQoLVcMsEvi/4bfWQNrUpw0DEOz mdNCmmOO/reZWGke9h/Pd618h9Tv8DRyIdgHHM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb9gmAsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+tRXVAoIYpbxvp+E2Je9 9c9FwAfRCnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmJS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMXwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVcviOOyb4eIEjCMbZ8Ogl2Jj HrWw3joWxwAPf3GzgrG6Uv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvqS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH69V5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:zYwkBaoTYjxUT0kE+sgHN6caV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:XyzZtGjTzH3waD/TwAKU0wFCbTJubEKM3WnMJAyEFW97S62XYnqvyLFOqp87 X-Talos-MUID: 9a23:Q30JRgqRjwq54f6NwEMez2s5KNx5yby+NFwcyJgcsujdMhwzIA7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536037755" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 099D3180001C5 for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 56B81CC124A; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 24/27] python3-git: fix CVE-2026-87817 Date: Thu, 15 Oct 2026 23:19:19 -0700 Message-Id: <20261016061922.843414-25-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247989 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b [2] https://www.cve.org/CVERecord?id=CVE-2026-87817 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-87817.patch | 430 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 431 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch new file mode 100644 index 0000000000..c69c906144 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch @@ -0,0 +1,430 @@ +From e1997b93556ee52ddb4ddfa2da174e8fdb4609cb Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 25 Aug 2026 04:57:29 +0200 +Subject: [PATCH 35/38] fix: prefer `.git` during repository discovery + + +GitPython considered worktree administration and bare-repository signatures +before a worktree's real .git entry. Align discovery with Git so .git files +and directories win, malformed .git files stop discovery, and candidate git +directories validate HEAD plus commondir-backed object and ref storage. This +addresses GHSA-239g-whfq-7xj9. + +Regression coverage compares ambiguous layouts with git rev-parse and rejects +invalid HEAD/.git metadata. + +Git baseline: 15c6308cf7ad276b306aa5b3ababfbdebfb1a917; setup.c +setup_git_directory_gently_1(), is_git_directory(), and validate_headref(). + +Repository validation can use GIT_COMMON_DIR for refs and objects. Preserve the +same value on Repo so later config, ref, and object access uses the directory +that made discovery succeed. + +Capture GIT_COMMON_DIR before the first repository config read so bare-state +detection uses the same metadata location as discovery. Resolve relative +environment values immediately so later working-directory changes cannot +retarget the Repo. + +Review feedback: relative GIT_COMMON_DIR left Git subprocesses resolving GIT_DIR +and GIT_COMMON_DIR from a different working directory; malformed commondir data, +empty GIT_OBJECT_DIRECTORY, and the linked-worktree signature were also handled +inconsistently. + +Pin the repository environment to resolved paths, reject invalid +metadata without consulting the process working directory, and +restore HEAD-based linked-worktree detection. Keep the loose HEAD +and dangling .git behavior because both match Git setup.c at baseline +15c6308cf7ad276b306aa5b3ababfbdebfb1a917. + +Review feedback identified that chained or self-referential .git pointers +recurse, filesystem-encoded metadata can fail text decoding, and a relative +GIT_DIR is not retained for later Git commands. + +Parse one regular, size-bounded Gitfile exactly once, decode Gitfile and +commondir paths with the filesystem codec, and retain the resolved GIT_DIR +for subprocesses. This rejects cycles like Git instead of recursing and keeps +commands stable after working-directory changes. + +Review feedback noted that a dangling commondir symlink was treated as absent, +allowing local objects and refs to validate the repository. + +Distinguish a truly missing commondir from a dangling symlink. This follows +Git's get_common_dir_noenv(), whose file_exists check uses lstat before +attempting to read the entry. + +Python 3.9 on Windows raised UnicodeDecodeError while the repository-discovery +regression test parsed invalid commondir bytes, causing the Python package test +(windows, 3.9) check to fail. + +Treat UnicodeError like an unreadable metadata file in both commondir and +gitfile parsing. Invalid bytes now make discovery reject the candidate +repository, matching Git's behavior. + +Review feedback noted that GIT_OBJECT_DIRECTORY made discovery succeed without +becoming the Repo ODB root, while a relative value could later be resolved from +the Git wrapper's different working directory. + +Resolve the environment value against the construction directory, use it as the +ODB root, and preserve the absolute value for later Git commands. The regression +moves the only object store outside the git directory and verifies access +through both GitDB and git cat-file after the original environment and current +directory are restored. + +Review feedback identified four setup mismatches: non-missing .git stat failures +could fall through to another repository, explicit GIT_DIR could be redirected +through a nested .git entry, Gitfile reads were not bounded to the stat-reported +size, and alternates ignored GIT_OBJECT_DIRECTORY. + +Match Git setup.c by bypassing discovery for an environment-selected GIT_DIR, +stopping discovery when Gitfile stat fails for reasons other than a missing +path, and reading exactly the previously observed Gitfile size. Resolve +alternates below the active ODB root so custom object stores remain internally +consistent. + +The commit review noted that treating every present GIT_DIR as explicit broke +two documented cases: an empty GIT_DIR must fall back to current-directory +discovery, while an empty Repo path must still use a nonempty GIT_DIR. + +CVE: CVE-2026-87817 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. +- Transport the discovery checks into the 3.1.42 Repo constructor/helper + layout. Omit upstream release-note changes. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 101 +++++++++++++++++++++++++++++++--------------- + git/repo/fun.py | 119 ++++++++++++++++++++++++++++++++++-------------------- + 2 files changed, 144 insertions(+), 76 deletions(-) + +diff --git a/git/repo/base.py b/git/repo/base.py +index ebad63b8..c8e8f6ed 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -218,6 +218,10 @@ class Repo: + ) -> None: + """Create a new Repo instance. + ++ .. note:: ++ Repositories using reftable may be opened, but GitPython's direct reference ++ access does not support reftable. ++ + :param path: + The path to either the root git directory or the bare git repo:: + +@@ -248,7 +252,11 @@ class Repo: + :return: git.Repo + """ + +- epath = path or os.getenv("GIT_DIR") ++ git_dir_env = os.getenv("GIT_DIR") ++ object_dir_env = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir_env is not None: ++ object_dir_env = osp.abspath(object_dir_env) ++ epath = path or git_dir_env + if not epath: + epath = os.getcwd() + if Git.is_cygwin(): +@@ -271,17 +279,49 @@ class Repo: + if not os.path.exists(epath): + raise NoSuchPathError(epath) + +- ## Walk up the path to find the `.git` dir. +- # +- curpath = epath +- git_dir = None ++ # Walk up the path to find the `.git` dir. ++ curpath = os.fspath(epath) if epath is not None else "" ++ git_dir: Optional[str] = None ++ explicit_git_dir = not path and bool(git_dir_env) + while curpath: + # ABOUT osp.NORMPATH +- # It's important to normalize the paths, as submodules will otherwise initialize their +- # repo instances with paths that depend on path-portions that will not exist after being +- # removed. It's just cleaner. ++ # It's important to normalize the paths, as submodules will otherwise ++ # initialize their repo instances with paths that depend on path-portions ++ # that will not exist after being removed. It's just cleaner. ++ if not explicit_git_dir: ++ dotgit = osp.join(curpath, ".git") ++ try: ++ sm_gitpath = find_submodule_git_dir(dotgit) ++ except OSError: ++ break ++ if sm_gitpath is not None: ++ # Worktrees can use relative paths as of Git 2.48, so join to curpath. ++ git_dir = osp.normpath(osp.join(curpath, os.fspath(sm_gitpath))) ++ self._working_tree_dir = curpath ++ break ++ ++ # Like Git, do not fall back to a bare repository or parent directory when ++ # a non-directory .git entry exists but is not a valid gitfile. ++ if osp.exists(dotgit) and not osp.isdir(dotgit): ++ break ++ + if is_git_dir(curpath): + git_dir = curpath ++ if osp.isfile(osp.join(curpath, "gitdir")) and osp.isfile(osp.join(curpath, "commondir")): ++ if "GIT_WORK_TREE" in os.environ: ++ self._working_tree_dir = os.getenv("GIT_WORK_TREE") ++ else: ++ # Linked worktree administrative directories store the path to ++ # the worktree's .git file in gitdir (without a "gitdir: " prefix). ++ with open(osp.join(git_dir, "gitdir")) as fp: ++ worktree_gitfile = fp.read().strip() ++ ++ if not osp.isabs(worktree_gitfile): ++ worktree_gitfile = osp.normpath(osp.join(git_dir, worktree_gitfile)) ++ ++ self._working_tree_dir = osp.dirname(worktree_gitfile) ++ break ++ + # from man git-config : core.worktree + # Set the path to the root of the working tree. If GIT_COMMON_DIR environment + # variable is set, core.worktree is ignored and not used for determining the +@@ -299,21 +339,7 @@ class Repo: + self._working_tree_dir = os.getenv("GIT_WORK_TREE") + break + +- dotgit = osp.join(curpath, ".git") +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is not None: +- git_dir = osp.normpath(sm_gitpath) +- +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is None: +- sm_gitpath = find_worktree_git_dir(dotgit) +- +- if sm_gitpath is not None: +- git_dir = expand_path(sm_gitpath, expand_vars) +- self._working_tree_dir = curpath +- break +- +- if not search_parent_directories: ++ if explicit_git_dir or not search_parent_directories: + break + curpath, tail = osp.split(curpath) + if not tail: +@@ -324,6 +350,16 @@ class Repo: + raise InvalidGitRepositoryError(epath) + self.git_dir = git_dir + ++ common_dir_env = os.getenv("GIT_COMMON_DIR") ++ if common_dir_env is not None: ++ self._common_dir = osp.abspath(common_dir_env) ++ else: ++ try: ++ common_dir = os.fsdecode((Path(self.git_dir) / "commondir").read_bytes()).rstrip("\r\n") ++ self._common_dir = osp.join(self.git_dir, common_dir) ++ except OSError: ++ self._common_dir = "" ++ + self._bare = False + try: + self._bare = self.config_reader("repository").getboolean("core", "bare") +@@ -331,12 +367,6 @@ class Repo: + # Let's not assume the option exists, although it should. + pass + +- try: +- common_dir = (Path(self.git_dir) / "commondir").read_text().splitlines()[0].strip() +- self._common_dir = osp.join(self.git_dir, common_dir) +- except OSError: +- self._common_dir = "" +- + # Adjust the working directory in case we are actually bare - we didn't know + # that in the first place. + if self._bare: +@@ -345,9 +375,15 @@ class Repo: + + self.working_dir: PathLike = self._working_tree_dir or self.common_dir + self.git = self.GitCommandWrapperType(self.working_dir) ++ if common_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir), GIT_COMMON_DIR=os.fspath(self.common_dir)) ++ elif git_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir)) ++ if object_dir_env is not None: ++ self.git.update_environment(GIT_OBJECT_DIRECTORY=object_dir_env) + + # Special handling, in special times. +- rootpath = osp.join(self.common_dir, "objects") ++ rootpath = object_dir_env if object_dir_env is not None else osp.join(self.common_dir, "objects") + if issubclass(odbt, GitCmdObjectDB): + self.odb = odbt(rootpath, self.git) + else: +@@ -876,8 +912,7 @@ class Repo: + + :return: List of strings being pathnames of alternates + """ +- if self.git_dir: +- alternates_path = osp.join(self.git_dir, "objects", "info", "alternates") ++ alternates_path = osp.join(self.odb.root_path(), "info", "alternates") + + if osp.exists(alternates_path): + with open(alternates_path, "rb") as f: +@@ -898,7 +933,7 @@ class Repo: + The method does not check for the existence of the paths in alts + as the caller is responsible. + """ +- alternates_path = osp.join(self.common_dir, "objects", "info", "alternates") ++ alternates_path = osp.join(self.odb.root_path(), "info", "alternates") + if not alts: + if osp.isfile(alternates_path): + os.remove(alternates_path) +diff --git a/git/repo/fun.py b/git/repo/fun.py +index 63bcfdfc..663b6ee1 100644 +--- a/git/repo/fun.py ++++ b/git/repo/fun.py +@@ -60,21 +60,61 @@ def is_git_dir(d: "PathLike") -> bool: + """This is taken from the git setup.c:is_git_directory + function. + +- @throws WorkTreeRepositoryUnsupported if it sees a worktree directory. It's quite hacky to do that here, +- but at least clearly indicates that we don't support it. +- There is the unlikely danger to throw if we see directories which just look like a worktree dir, +- but are none.""" ++ .. note:: ++ This function recognizes repositories using reftable through their ++ compatibility files, but GitPython's direct reference access does not support ++ reftable. ++ ++ :raise git.exc.WorkTreeRepositoryUnsupported: ++ If it sees a worktree directory. It's quite hacky to do that here, but at least ++ clearly indicates that we don't support it. There is the unlikely danger to ++ throw if we see directories which just look like a worktree dir, but are none. ++ """ + if osp.isdir(d): +- if (osp.isdir(osp.join(d, "objects")) or "GIT_OBJECT_DIRECTORY" in os.environ) and osp.isdir( +- osp.join(d, "refs") +- ): +- headref = osp.join(d, "HEAD") +- return osp.isfile(headref) or (osp.islink(headref) and os.readlink(headref).startswith("refs")) +- elif ( +- osp.isfile(osp.join(d, "gitdir")) +- and osp.isfile(osp.join(d, "commondir")) +- and osp.isfile(osp.join(d, "gitfile")) +- ): ++ headref = osp.join(d, "HEAD") ++ if osp.islink(headref): ++ try: ++ valid_head = os.readlink(headref).startswith("refs/") ++ except OSError: ++ valid_head = False ++ else: ++ try: ++ with open(headref, "rb") as fp: ++ head = fp.read(256) ++ except OSError: ++ valid_head = False ++ else: ++ valid_head = (head.startswith(b"ref:") and head[4:].lstrip().startswith(b"refs/")) or bool( ++ re.match(rb"(?:[0-9A-Fa-f]{64}|[0-9A-Fa-f]{40})", head) ++ ) ++ ++ common_dir = os.getenv("GIT_COMMON_DIR") ++ if common_dir == "": ++ return False ++ if common_dir is None: ++ common_dir_file = Path(d) / "commondir" ++ try: ++ common_dir = os.fsdecode(common_dir_file.read_bytes()).rstrip("\r\n") ++ except FileNotFoundError: ++ if osp.lexists(common_dir_file): ++ return False ++ common_dir = os.fspath(d) ++ except (OSError, UnicodeError): ++ return False ++ else: ++ if not common_dir: ++ return False ++ try: ++ common_dir = osp.realpath(osp.join(d, common_dir)) ++ except (OSError, ValueError): ++ return False ++ ++ object_dir = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir is None: ++ object_dir = osp.join(common_dir, "objects") ++ if valid_head and osp.isdir(object_dir) and osp.isdir(osp.join(common_dir, "refs")): ++ return True ++ if osp.isfile(osp.join(d, "gitdir")) and osp.isfile(osp.join(d, "commondir")) and osp.isfile(headref): + raise WorkTreeRepositoryUnsupported(d) + return False + +@@ -83,19 +123,20 @@ def find_worktree_git_dir(dotgit: "PathLike") -> Optional[str]: + """Search for a gitdir for this worktree.""" + try: + statbuf = os.stat(dotgit) +- except OSError: ++ except (FileNotFoundError, NotADirectoryError): + return None +- if not stat.S_ISREG(statbuf.st_mode): ++ if not stat.S_ISREG(statbuf.st_mode) or statbuf.st_size > (1 << 20): + return None + + try: +- lines = Path(dotgit).read_text().splitlines() +- for key, value in [line.strip().split(": ") for line in lines]: +- if key == "gitdir": +- return value +- except ValueError: +- pass +- return None ++ with open(dotgit, "rb") as fp: ++ content_bytes = fp.read(statbuf.st_size) ++ if len(content_bytes) != statbuf.st_size: ++ return None ++ content = os.fsdecode(content_bytes).rstrip("\r\n") ++ except (OSError, UnicodeError): ++ return None ++ return content[8:] if len(content) >= 9 and content.startswith("gitdir: ") else None + + + def find_submodule_git_dir(d: "PathLike") -> Optional["PathLike"]: +@@ -103,26 +144,18 @@ def find_submodule_git_dir(d: "PathLike") -> Optional["PathLike"]: + if is_git_dir(d): + return d + +- try: +- with open(d) as fp: +- content = fp.read().rstrip() +- except IOError: +- # it's probably not a file +- pass +- else: +- if content.startswith("gitdir: "): +- path = content[8:] +- +- if Git.is_cygwin(): +- ## Cygwin creates submodules prefixed with `/cygdrive/...` suffixes. +- # Cygwin git understands Cygwin paths much better than Windows ones +- # Also the Cygwin tests are assuming Cygwin paths. +- path = cygpath(path) +- if not osp.isabs(path): +- path = osp.normpath(osp.join(osp.dirname(d), path)) +- return find_submodule_git_dir(path) +- # END handle exception +- return None ++ path = find_worktree_git_dir(d) ++ if path is None: ++ return None ++ ++ if Git.is_cygwin(): ++ # Cygwin creates submodules prefixed with `/cygdrive/...`. ++ # Cygwin git understands Cygwin paths much better than Windows ones. ++ # Also the Cygwin tests are assuming Cygwin paths. ++ path = cygpath(path) ++ if not osp.isabs(path): ++ path = osp.normpath(osp.join(osp.dirname(d), path)) ++ return path if is_git_dir(path) else None + + + def short_to_long(odb: "GitCmdObjectDB", hexsha: str) -> Optional[bytes]: +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 54bc423fa6..decd1ccc00 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -47,6 +47,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ + file://CVE-2026-87817.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101046 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9051BCCA491 for ; Fri, 16 Oct 2026 06:19:45 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15907.1792131585117587496 for ; Thu, 15 Oct 2026 23:19:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=MaQRl4Pk; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3462; q=dns/txt; s=iport01; t=1792131585; x=1793341185; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=81Lyujc4f8WoJ+juPj3i+8o8oxDZD380ozRoyFpkrow=; b=MaQRl4PkUdkcB1YyofC4jIx25Re5HlaT9YAg7ySU+gNX6UyxyxxCrvWZ reRtF+cFwFd5mUmVDC77dFFKaHreAef9C11mL3rixqvTbBbxLBeSNrp8f fQd0KHO5UEV/y0jf7ZyhoqEqa1BaSQSRE/YegBjczTvaVZbMCEkbYWv2s Ld/5AxaEGwLTT7++MRjWPRxOPKaPR4mf41qYnz2RiICtfxDFcskNnmGXE oMywyt6SJkICAInRTeqz6uvpwMPCPmWVkhiLW2fyhfC2Mt0l1qgs1Ama5 qT0/DAsP4ADgqhVnptT7qRFHUb6zy3P5+Y/ZyWZC3NkYyxzZfQujuwcSX A==; X-CSE-ConnectionGUID: 5U6Cok7WSvSegLgnpUXN1w== X-CSE-MsgGUID: KaVmTxegSOqFa/fNHKyCQQ== X-IPAS-Result: A0BIAgBfwdFq/5H/Ja1aglmCV3VgQ0mUKYIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxzgXkzgQGDKQE/AkNQ2EsQb4FoAQsUAYE4hUCII10YAYR8JxuBSUSBFYNpgQWBXAICGIgLBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoFyJjsSPVEBK4IDd5JXklChD4QojCKVOhozhASBV5JAklQLmH2OCpZPhGmBaDyBRA4HMxoIGxWDIglKGQ+OOYNrhRNRyHYnMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:HR/BZq3L29ewlb3SyvbD5YVwkn2cJEfYwER7XKvMYLTBsI5bpzcPm GcXXmiPaPjYamb3KNB0atng80gPuJDcm4VhGwJv3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGUXxoFoobpdlMH1pD+ tgXLigwXjbamLfjqF67YrEEasULNsLnOsYb/3pn1zycVaZgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUidC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsi+axYIeIJobiqcN9vU+mo 17W8mvCJQg0PZuR7xqm41mVv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Ms0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:OFjh96BhOOQ4XmLlHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:FCpavWgcFNzLTS37QH72u4mw3jJuL0CD53DTfHCDF11kR5maT0etyIU9jJ87 X-Talos-MUID: 9a23:Qc4N9wp03ZUhCaHxKG4ezxJrCsJU86mhM2cUv5xBte+kFj1bAg7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536485542" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 0A5951800047E for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 5C436CBEF6F; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 25/27] python3-git: fix CVE-2026-87818 Date: Thu, 15 Oct 2026 23:19:20 -0700 Message-Id: <20261016061922.843414-26-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247994 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8 [2] https://www.cve.org/CVERecord?id=CVE-2026-87818 Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-87818.patch | 56 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch new file mode 100644 index 0000000000..98d120e2e7 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch @@ -0,0 +1,56 @@ +From 03a6fe1a628749fb173d8b7e020ceb01c150c600 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 17 Aug 2026 06:15:12 +0200 +Subject: [PATCH 36/38] fix: require opt-in for no-index diffs + + +Treat --no-index as an unsafe diff option because it changes path operands +from repository pathspecs to arbitrary filesystem paths. This addresses +GHSA-whh4-5q6c-9v3x without exposing advisory reproduction details. + +CVE: CVE-2026-87818 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 09f2cf383a992d1af697364569e9f384748c1bd8) +Signed-off-by: Yogita Urade +--- + git/diff.py | 4 ++-- + git/repo/base.py | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index 84e7687b..7db268ff 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -136,8 +136,8 @@ class Diffable: + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` and ``-O`` that can write to +- or read from arbitrary filesystem paths. ++ If ``True``, allow options such as ``--output``, ``--no-index``, and ``-O`` ++ that can write to or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to git-diff, such as ``R=True`` to swap both +diff --git a/git/repo/base.py b/git/repo/base.py +index c8e8f6ed..e0d12439 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -195,6 +195,8 @@ class Repo: + ] + + unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Treats path operands as arbitrary filesystem paths. ++ "--no-index", + # Reads caller-controlled order patterns from an arbitrary file. + "-O", + "--orderfile", +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index decd1ccc00..71275b0861 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -48,6 +48,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ + file://CVE-2026-87818.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101042 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38F07CCF2C9 for ; Fri, 16 Oct 2026 06:19:35 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15612.1792131564472441473 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=aWNTyXNM; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6976; q=dns/txt; s=iport01; t=1792131564; x=1793341164; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Z3aprRDK9i4kQnMS0A4pWCCWxvu1bfw+iXQZ+f1o9MM=; b=aWNTyXNMYQA7WmUUJazSMuGy6SHYc0mC49RaOetkiqYAPQ+jHXIvUeEw fZfbe/BB5C1Y98MJvoQoHEkV79YmMl+c7JSuXu/nwmGmCQEUmhJLJAbfD ddXd2VVyqZyWnbOXsPdNlRvZ3nQKj1crjylzRsqhztMEd8W7854EfeNOi JgVSu3L5Qzq+6QQgRW5HF9NfK57SF4lgdKfyyhPR1AxWLZnFbvwSUU6NM iDaLh6WLYMYzwFs9FVamCE1AcaynChvtBwvHaef2i5MmTxCI2BrVhSZaP JXQtdNT7JCoWWwOqlPNbXksHEK89mLM17aebwmfZEaNWp5DBnE7vFGmwG g==; X-CSE-ConnectionGUID: 8JHpJmfOSy2dBIJRny9ecA== X-CSE-MsgGUID: HNVpWVK2TcKMWFKFi907dQ== X-IPAS-Result: A0BKAgBrwNFq/5D/Ja1RCYJZgld1YENJlCmBNWwDkx6KfhSBag8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvHaBeTOBAYMpAT8CQ1DYSxBvgWgBCxQBgTiFQIgjXRgBRIQ4JxuBSUSBFYNpgQWBXAICGIERAQgKAYZmBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIYRgc9GzYBJQYXgXSTVgIIkBWCIaEPhCiMIpU6GjOEBIFXkkCSVAuYfY4KlWcxN4RpgWg8aXAzGggbFYMiCUoZD445g2uFE1FsyAonMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:sM8VGqtFZkAduxnZvAUKvtxft+fnVAFfMUV32f8akzHdYApBsoF/q tZmKW/QO66PYWLye9kgat6z9kkAv8SDx9NiSlNtq3xnHyNAgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvra9ks21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIwqsRXGUNL+ 9sjOWoBRDGhveSnkb+wY7w57igjBJGD0II3oHpsy3TdSP0hW52GG/qM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtLYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIIYHRHpkMzhnwS mTu30LHGi4kF4ajwhmgzVyPqO6exXz3YddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEXhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Pxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:+mHSQK8FqxLTVWyRXjRuk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:TGfH6m7STgoalbSpEtsspGw0AuIgfFrm3S3cCW6aM2B4GbCeYArF X-Talos-MUID: 9a23:+QdFvA4rnTwP5ZAfmN1pG09RxoxIxZq2N34uy6kNmOy7Gw9eOmbF0ziOF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535334187" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 0C86E180003C5 for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 6218DCBEF78; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 26/27] python3-git: fix CVE-2026-87819 Date: Thu, 15 Oct 2026 23:19:21 -0700 Message-Id: <20261016061922.843414-27-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247978 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8 [2] https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f [3] https://www.cve.org/CVERecord?id=CVE-2026-87819 Signed-off-by: Yogita Urade --- .../python3-git/CVE-2026-87819_p1.patch | 78 +++++++++++++++++++ .../python3-git/CVE-2026-87819_p2.patch | 58 ++++++++++++++ .../python/python3-git_3.1.42.bb | 2 + 3 files changed, 138 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch new file mode 100644 index 0000000000..46ce789834 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch @@ -0,0 +1,78 @@ +From dc8a898eb74ac5614c7ca013de21e30e8dac2e17 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 11 Aug 2026 14:18:25 +0200 +Subject: [PATCH 37/38] fix: parse actor identities without regular expressions + + +GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor +identity contains a long unterminated email delimiter. + +Add a regression that exercises a 20,000-character malformed identity, +then replace both actor regexes with direct delimiter scans following +Git's first-opening, first-closing delimiter behavior. Keep GitPython's +whole-string fallback when either delimiter is absent. + +Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95 +ident.c::split_ident_line and its invalid-committer cases in +t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and +lenient identity tests. + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8] + +Backport Changes: +- Omit upstream regression test changes because the current PyPI + source archive does not include its test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 751473a5f3221d6f989291cbebcc404353fd3ba8) +Signed-off-by: Yogita Urade +--- + git/util.py | 24 ++++++++---------------- + 1 file changed, 8 insertions(+), 16 deletions(-) + +diff --git a/git/util.py b/git/util.py +index d3eaeb8b..292d5671 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -756,10 +756,6 @@ class Actor: + can be committers and authors or anything with a name and an email as + mentioned in the git log entries.""" + +- # PRECOMPILED REGEX +- name_only_regex = re.compile(r"<(.*)>") +- name_email_regex = re.compile(r"(.*) <(.*?)>") +- + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +@@ -802,18 +798,14 @@ class Actor: + + :return: Actor + """ +- m = cls.name_email_regex.search(string) +- if m: +- name, email = m.groups() +- return Actor(name, email) +- else: +- m = cls.name_only_regex.search(string) +- if m: +- return Actor(m.group(1), None) +- # Assume the best and use the whole string as name. +- return Actor(string, None) +- # END special case name +- # END handle name/email matching ++ line = string.partition("\n")[0] ++ left_bracket = line.find("<") ++ right_bracket = line.find(">", left_bracket + 1) ++ if left_bracket >= 0 and right_bracket >= 0: ++ return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) ++ ++ # Assume the best and use the whole string as name. ++ return Actor(string, None) + + @classmethod + def _main_actor( +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch new file mode 100644 index 0000000000..6ae8f9fa2b --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch @@ -0,0 +1,58 @@ +From 9dbeb7f4547045013db152c84d7dbacbdf12bc62 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Fri, 28 Aug 2026 08:37:50 +0200 +Subject: [PATCH] Restore deprecated Actor regex compatibility + +Keep the existing name_email_regex attribute available for Scarthgap +callers while warning about its quadratic behavior on malformed input. +The parser continues to use the CVE fix's delimiter scan. + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f] + +Backport Changes: +- Keep the Scarthgap Actor._from_string API and fold only the deprecated + regex shim; Actor.from_string was added after 3.1.42. +- Omit the upstream regression tests because the current PyPI source + archive does not include its test suite. + +(cherry picked from commit bc63b027e2fc737e2ec0222bfa764e1aa76a427f) +Signed-off-by: Yogita Urade +--- + git/util.py | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/git/util.py b/git/util.py +index 292d5671..d2f1915b 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -751,11 +751,26 @@ class CallableRemoteProgress(RemoteProgress): + self._callable(*args, **kwargs) + + ++class _DeprecatedActorNameEmailRegex: ++ _pattern = re.compile(r"(.*) <(.*?)>") ++ ++ def __get__(self, _instance: Any, _owner: Any) -> Pattern[str]: ++ warnings.warn( ++ "Actor.name_email_regex is deprecated because matching long malformed strings can take quadratic time. " ++ "Use Actor._from_string() to parse actor identities, or Actor(name, email) when the fields are separate.", ++ DeprecationWarning, ++ stacklevel=2, ++ ) ++ return self._pattern ++ ++ + class Actor: + """Actors hold information about a person acting on the repository. They + can be committers and authors or anything with a name and an email as + mentioned in the git log entries.""" + ++ name_email_regex = _DeprecatedActorNameEmailRegex() ++ + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +-- +2.35.6 + diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 71275b0861..0102e8c329 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -49,6 +49,8 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ file://CVE-2026-87818.patch \ + file://CVE-2026-87819_p1.patch \ + file://CVE-2026-87819_p2.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb" From patchwork Fri Oct 16 06:19:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101028 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4CB5CCF2C1 for ; Fri, 16 Oct 2026 06:19:33 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15900.1792131564578225035 for ; Thu, 15 Oct 2026 23:19:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=V62TXx+Y; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4062; q=dns/txt; s=iport01; t=1792131565; x=1793341165; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=ELrdwSGPA1zINKc6eLv2XrinJ204DG9HLMAdLaDNlk4=; b=V62TXx+Y57LX2Tdxc6f+sf9hfoIBVMIG36jOrl4bcUmXA3d8uR2yFgBj v9+h58JrMQ8oTSkznO+LVx94Po+2L6oHYxEL5pcjYBbEblKf59a1PB7wc fqkgc4rNna8I7INqZEs6zyCLMI4L90uMJ97WPS3a1ZzmprOJzT1+FpdVT TlUmh7DyowJKsMdrpxCXFu0SCEWMk/PR8OxbmSBLWrwfXkKPkB32LEDRA hPbLJAvNHjhv7x3mGiFAqWoNF7gZfEDDFCaWiRNw9HDxRqdqfk8/xJ0Zh 6ruBrbSd7JkoaQT6L7N4koJiSBzm4HjVx6gvbGA+druwGWaO/DxTO7fYo g==; X-CSE-ConnectionGUID: JNqGlZNiQHqlg41LBJNCLA== X-CSE-MsgGUID: 5X2yNK1nReO78qA39iWrrg== X-IPAS-Result: A0BIAgDpwNFq/5D/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0gAi8rIwgZgwIBgjoDNwMRvHaBeTOBAYMpAYFU2EsQb4FoAQsUAYE4hUCII10YAUSCVYFjJxuBSUSBFYNpgQWBXAKIJQSDHBKXIUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQeghhNgQ4BK1CBKDSldaEPhCiMIpU6GjOEBIFXpRQLmH2CWYsxlk+EaYFoPIFZMxoIGxWDIglKGQ+OOYNrhWTIdicyAgkDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:iljdCa5QEIaM/YfiPdGb5QxRtG/GchMFZxGqfqrLsTDasY5as4F+v mRNXmmBMvrYMzPyL40iO4Wx90wC65LQn9c2GQY/ri0xZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eH6sB1eJFJ2B31 eUcJ2xUSjqhocmS6efuIgVsrpxLwMjDJogTvDRkiDreF/tjGc+FSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkETUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwa4SNIYPVGJk9ckCw+ 1Kc7kLaWxcgOfvAmSOsqSOtufXVknauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWS4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:UsXZPqA6YGFeZbzlHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:7SYSf2yoD48liZahXWqbBgU2PNkKdk/7zU7wOku3VT9NYp+zYnu5rfY= X-Talos-MUID: 9a23:w/eKaA+vVprXVNmS/Z+OKt2Qf5pYubWIKxkLq5gh5JmdHHchOgiHljviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536037754" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:19:24 +0000 Received: from sjc-ads-7310.cisco.com (sjc-ads-7310.cisco.com [10.30.220.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 0E104180003CB for ; Fri, 16 Oct 2026 06:19:24 +0000 (GMT) Received: by sjc-ads-7310.cisco.com (Postfix, from userid 1889728) id 6793ECBEF79; Thu, 15 Oct 2026 23:19:23 -0700 (PDT) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap][PATCH 27/27] python3-git: fix CVE-2026-100689 Date: Thu, 15 Oct 2026 23:19:22 -0700 Message-Id: <20261016061922.843414-28-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016061922.843414-1-yurade@cisco.com> References: <20261016061922.843414-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: VERIFIED;sjc-ads-7310.cisco.com [10.30.220.95];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.220.95, sjc-ads-7310.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:19:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247984 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 [2] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w Signed-off-by: Yogita Urade --- .../python/python3-git/CVE-2026-100689.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch new file mode 100644 index 0000000000..2712854d6f --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch @@ -0,0 +1,60 @@ +From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001 +From: Byron +Subject: [PATCH] Reject submodule checkout paths outside the repository + +The submodule path from .gitmodules reaches filesystem operations during +update without the containment validation used by other operations. +Validate the checkout path and reject symbolic links before returning its +absolute path. + +CVE: CVE-2026-100689 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093] + +Backport Changes: +- GitPython 3.1.42's _to_relative_path() does not reject relative parent + traversal or the repository root. Add canonical containment validation + in abspath before its upstream component and symlink checks. +- Omit upstream regression tests because the PyPI source archive does not + contain the test suite. Omit the documentation-only release note. + +(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 84d6bcdc..d6d317ab 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -354,4 +354,28 @@ class Submodule(IndexObject, TraversableIterableObj): + return path + ++ @property ++ def abspath(self) -> PathLike: ++ root = self.repo.working_tree_dir ++ if root is None: ++ return super().abspath ++ ++ root = osp.realpath(root) ++ checkout_path = osp.realpath(osp.join(root, os.fspath(self.path))) ++ try: ++ common_path = osp.commonpath([root, checkout_path]) ++ except ValueError as e: ++ raise ValueError("Submodule checkout path %r is not in repository" % self.path) from e ++ if osp.normcase(common_path) != osp.normcase(root): ++ raise ValueError("Submodule checkout path %r is not in repository" % self.path) ++ if osp.normcase(checkout_path) == osp.normcase(root): ++ raise ValueError("Submodule checkout path must not be the repository root") ++ ++ path = root ++ for component in os.fspath(self._to_relative_path(self.repo, self.path)).split("/"): ++ path = join_path_native(path, component) ++ if osp.islink(path): ++ raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path) ++ return path ++ + @classmethod + def _write_git_file_and_module_config(cls, working_tree_dir: PathLike, module_abspath: PathLike) -> None: +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb index 0102e8c329..59c40b575a 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.42.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb @@ -51,6 +51,7 @@ SRC_URI += " file://CVE-2026-42284.patch \ file://CVE-2026-87818.patch \ file://CVE-2026-87819_p1.patch \ file://CVE-2026-87819_p2.patch \ + file://CVE-2026-100689.patch \ " SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"