From patchwork Fri Nov 6 14:43:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103292 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7336.1793976213937852288 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fTtdy/JP; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5868; q=dns/txt; s=iport01; t=1793976213; x=1795185813; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=fj+1KrJqVNrM7FeCeSyRT80Rx34BzGULroW802BoQAI=; b=fTtdy/JPVhxgEGooywkmw+Nt15Awfd4PwasNmnOnQkU055GnlGTCULNi Tzf1YmsllcyXW0i6bAlhoBfg4sC1f6d1FR2A/ySfWrfPMqfKXDBNWXa2Y 8hN+tHDgFNpBD0lJNni8en2auCNgGSR2YKUILG/khbe2yV6zr2vJmM2mm /a1B0++81M9xht7mEKR0UrBYCw0761jVm827Kwd1syI7DxBHYzlilX3pV qc4dneq4wglJ2qLAyv8wRcFK2lLKTxyIZSwfNQkUo346Xjw+yisqt4JCV WKSgQb03HKdg1mb44Ioqp1PKcpAOitpmzVJjD8UcDfvSyPb7sag2PthKm A==; X-CSE-ConnectionGUID: v+wLQFgXSSml1EzZpl4QWw== X-CSE-MsgGUID: EqO+aqObQ9KXgOXXAsJwyw== X-IPAS-Result: A0AaAAAQ5u1q/5X/Ja1aHAECAgEHARQBBAQBgX0HAQwBglZ1YENJA4xvhziCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8P4F5M4EBgmZDAT8CAkABUNhMEG+BaAELFAGBOAGFQYgkXRgBRIQ5JxuBSUSEfoEFgVwCAoElhn8EgxwSgVqNGAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CHyZNPSQtASsXL4FmTpJpATmPZIIhgTWfXIQqjCSVOhozhVulFguYfY4KllGEaYFoPIFZMxoIGxWDIglKGQ+OKw4Lg2CFE1HGCCYyAgkDLwEBBwIHDgMLgWiEYYsfAiYHgU8BAQ IronPort-Data: A9a23:TnlIUaLwb+Qwmv9QFE+RhpQlxSXFcZb7ZxGr2PjKsXjdYENS3mcPz zNKWDjVOP6OY2ekL9B2PNvk/UgOvMDXnYVkTAId+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYpajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1wT14SBKMXyt1MBGUX2 O4qMDRRVy+c0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAV7AtQIvIROPB4towMDUY358VW62BI ZBENHw2MEWojx5nYj/7DLovgf2hinTXeDxDo1XTrq0yi4TW5FEtjeO9boaMKrRmQ+14h2Hbr 3vh9V2oISEVE+yv4CGn7WOz07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/OOpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:xkKXJq/YqOTuxA/q43duk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:c/AmXG8jvE0/8JjlRs2Vv1BXBeQcXHLt90zVJxaVG1RxTOGsdkDFrQ== X-Talos-MUID: 9a23:kP9HiwwiAkUjPXl0MIwoW3+izcmaqIm3LwMEiLIMgpinBSNXCwe0lxaoU5Byfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386418" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 098B818000337 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id A184ACBF201; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 01/27] python3-git: fix CVE-2026-67326 Date: Fri, 6 Nov 2026 06:43:05 -0800 Message-Id: <20261106144331.3354811-2-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249663 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06 [2] https://security-tracker.debian.org/tracker/CVE-2026-67326 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Cleaned whitespace in the Backport Changes note. --- .../python/python3-git/CVE-2026-67326.patch | 107 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 108 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch new file mode 100644 index 0000000000..82fc987fcc --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch @@ -0,0 +1,107 @@ +From 89d7d33485f67d5f25777079797ae6d1a4538f86 Mon Sep 17 00:00:00 2001 +From: "GPT 5.5" +Date: Tue, 5 May 2026 21:34:42 +0800 +Subject: [PATCH] Validate config key section names before writing + +GitConfigParser already rejected CR, LF, and NUL in config values before +writing, but section and option names could still reach configparser. Because +GitPython writes section headers itself, a newline-bearing section name could +split the output into additional headers. + +Reject CR, LF, and NUL in section and option names on write paths that create +or set config keys: add_section(), set(), set_value(), add_value(), and +rename_section() destinations. This matches Git config key validation behavior; +Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys +containing newlines from config.c, and local git 2.50.1 rejects newline-bearing +config keys. + +Add a regression test covering unsafe section and option names while preserving +safe writes. + +CVE: CVE-2026-67326 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 54538428f79b0c91ba52cda5229856a6edf7ac06) +Signed-off-by: Yogita Urade +--- + git/config.py | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/git/config.py b/git/config.py +index 1595d51f..236de3a6 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -71,6 +71,9 @@ class MetaParserBuilder: + + See: https://git-scm.com/docs/git-config#_conditional_includes + """ ++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") ++"""Characters that cannot be safely written in config names or values.""" ++ + + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 +@@ -759,6 +762,7 @@ GitConfigParser.add_section + + def add_section(self, section: str) -> None: + """Assures added options will stay in order.""" ++ self._assure_config_name_safe(section, "section") + return super().add_section(section) + + @property +@@ -865,9 +869,13 @@ GitConfigParser._value_to_string_safe + + def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str: + value_str = self._value_to_string(value) +- if re.search(r"[\r\n\x00]", value_str): ++ if UNSAFE_CONFIG_CHARS_RE.search(value_str): + raise ValueError("Git config values must not contain CR, LF, or NUL") + return value_str ++ def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: ++ if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): ++ raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ + + @needs_values + @set_dirty_and_flush_changes +@@ -877,6 +885,8 @@ GitConfigParser.set + option: str, + value: Union[str, bytes, int, float, bool, None] = None, + ) -> None: ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + if value is not None: + value = self._value_to_string_safe(value) + return super().set(section, option, value) +@@ -901,6 +911,8 @@ GitConfigParser.set_value + :return: + This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -929,6 +941,8 @@ GitConfigParser.add_value + :return: + This instance + """ ++ self._assure_config_name_safe(section, "section") ++ self._assure_config_name_safe(option, "option") + value_str = self._value_to_string_safe(value) + if not self.has_section(section): + self.add_section(section) +@@ -949,6 +963,7 @@ GitConfigParser.rename_section + """ + if not self.has_section(section): + raise ValueError("Source section '%s' doesn't exist" % section) ++ self._assure_config_name_safe(new_name, "section") + if self.has_section(new_name): + raise ValueError("Destination section '%s' already exists" % new_name) + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index ebb5e4b442..474206d4ed 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -21,6 +21,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44243_p2.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ + file://CVE-2026-67326.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103277 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VL/Kag4x; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=15600; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=gr1rEDswaQS264q1SbQW6W7V2I5wQqJp1hQf26UeihQ=; b=VL/Kag4x7sB/HKFALYIckBI+ArNAKb4+WNwg+hWW/uXUJ+yROST+NiRW UuLa9mXU9CrmOStuHRaQUJSmxryfHk+QeWGJGPBFuJ8JA9zeWlgsbrWyH 5o5Fp++kZkZEaICN9KKvfgJ4aBi93O9zbvOEq6hwD3elwUh4Qa2qU9Mcj 55mVuoVCyxlbnxCarVJumteCTTEfUN9cuHeHxcERvXWWftL6OG+UM55r3 YxP2mgFWTHeax7TEtOcg19zxEhREncM4oOxgFWPsIdUgj0gMYoTYqIjhD oKeCddmdONmR7fZZ6VvpVfsdXtHQmEOEFErgQPWdkX7x9gUBW/72SL/6P A==; X-CSE-ConnectionGUID: FsKXNF2cT4+uJl1UOBLWvw== X-CSE-MsgGUID: A+YCs7FCQ/qaORRdhUXX0g== X-IPAS-Result: A0BJAgAN5+1q/5L/Ja1aglmCV3VgQ0kDlCeCIQOeIYEbA2APAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxNgXkzgQGDKQE/AgJAAVDYTBBvgWgBCxQBgTiFQogkXRgBRIJWgWMnG4FJRIEVg2mBBYEyKgICggqGGgSDHBKBWoEDjBUCgVFbhh5IgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYJFCDMSPSQtASsiWUgKGxAcGBwGLJJnA5AdgiGhEYQqjCSVOhozhVulFguYfY4KllGEaYFoPIFZMxoIGxU7gmcJShkPjisOC4NghRNRxggmMgIGAwMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:0HSI4azb0u/oH6UIZBV6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkVTn TAbWjuAOqnfYWfwfYhzPIq/pExQu5LSnYdiGlA9rlhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJG8tHr0+1Lx8PT0N6 N4ccQ0qRDS8mf3jldpXSsE07igiBNPgMIVavjRryivUSK53B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPXWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeO1YIaMKozXLSlTtm/bl 0ndoErSO1YDPful8zaFz0Kc3uCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1ffDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:BMxxE6E5NVjWC24BpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:TXk1fWjs1w6foTu4rzZIu9ixSTJuXGb+/FH+eUSEVSV0arnMdHi63Jx6jJ87 X-Talos-MUID: 9a23:M53lrgwyJZEoMG0BmtHHmK+nxVeaqI3tOWsWzrstgo6dPAtKATudsQSHGoByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841885" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 0F5551800023E for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id A8325CBF202; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 02/27] python3-git: fix CVE-2026-67323 Date: Fri, 6 Nov 2026 06:43:06 -0800 Message-Id: <20261106144331.3354811-3-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249687 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738 [2] https://security-tracker.debian.org/tracker/CVE-2026-67323 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Changed the ls_remote documentation to describe --upload-pack without --exec. --- .../python/python3-git/CVE-2026-67323.patch | 356 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 357 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch new file mode 100644 index 0000000000..3901f6244b --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67323.patch @@ -0,0 +1,356 @@ +From 80bf84d6f24adcc181b78d71fa94544924a85b2c Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 15:06:42 +0200 +Subject: [PATCH] fix: Guard unsafe git command options (GHSA-956x-8gvw-wg5v) + +Reject command options that can execute arbitrary helpers or write files when passed through archive, revision traversal, blame, clone, fetch, pull, push, and ls-remote APIs. Validate positional option tokens and transformed keyword options consistently, including Git-supported long-option abbreviations, attached short-option values, and falsey stringifiable remotes. Preserve explicit allow_unsafe_options and allow_unsafe_protocols escape hatches. + +Add regression coverage for each guarded API, option spelling and abbreviation forms, inert keyword values, mixed positional and keyword candidates, tuple blame options, stringifiable remotes, and unsafe commands that must not create marker files. + +CVE: CVE-2026-67323 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738] + +Backport Changes: +- Omitted test/test_clone.py, test/test_commit.py, test/test_git.py, + test/test_remote.py, test/test_repo.py because the current PyPI + source archive does not include the test suite and the python3-git + recipe does not run it. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 701ce32fe5ba8cb622c0e0342a376a6beb47d738) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 37 +++++++++++++++++++++- + git/objects/commit.py | 12 +++++++ + git/remote.py | 15 ++++++-- + git/repo/base.py | 80 +++++++++++++++++++++++++++++++++++++++---- + 4 files changed, 133 insertions(+), 11 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index bb8f93a8..87866be2 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -414,6 +414,11 @@ class Git: + "_version_info_token", + ) + ++ unsafe_git_ls_remote_options = [ ++ # This option allows arbitrary command execution in git-ls-remote. ++ "--upload-pack", ++ ] ++ + re_unsafe_protocol = re.compile(r"(.+)::.+") + + def __getstate__(self) -> Dict[str, Any]: +@@ -742,6 +747,20 @@ Git.check_unsafe_options + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) + ++ @classmethod ++ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]: ++ """Collect possible option spellings before command-line transformation.""" ++ options = [ ++ option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-") ++ ] ++ if kwargs: ++ for key, value in kwargs.items(): ++ values = value if isinstance(value, (list, tuple)) else (value,) ++ if any(value is True or (value is not False and value is not None) for value in values): ++ key = str(key) ++ options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") ++ return options ++ + class AutoInterrupt: + """Process wrapper that terminates the wrapped process on finalization. + +@@ -999,6 +1019,22 @@ Git.__getattr__ + return super().__getattribute__(name) + return lambda *args, **kwargs: self._call_process(name, *args, **kwargs) + ++ def ls_remote( ++ self, ++ *args: Any, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union[str, bytes, Tuple[int, Union[str, bytes], str], "Git.AutoInterrupt"]: ++ """List references in a remote repository. ++ ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--upload-pack``. ++ """ ++ if not allow_unsafe_options: ++ candidate_options = self._option_candidates(args, kwargs) ++ Git.check_unsafe_options(options=candidate_options, unsafe_options=self.unsafe_git_ls_remote_options) ++ return self._call_process("ls_remote", *args, **kwargs) ++ + def set_persistent_git_options(self, **kwargs: Any) -> None: + """Specify command line options to the git executable for subsequent + subcommand calls. +@@ -1488,7 +1524,7 @@ Git._unpack_args + return args + + @classmethod +- def _unpack_args(cls, arg_list: Sequence[str]) -> List[str]: ++ def _unpack_args(cls, arg_list: Sequence[Any]) -> List[str]: + outlist = [] + if isinstance(arg_list, (list, tuple)): + for arg in arg_list: +diff --git a/git/objects/commit.py b/git/objects/commit.py +index d957c905..6e2ff759 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -85,6 +85,12 @@ class Commit: + + # INVARIANTS + default_encoding = "UTF-8" ++ # Options to :manpage:`git-rev-list(1)` that can overwrite files. ++ unsafe_git_rev_options = [ ++ "--output", ++ "-o", ++ ] ++ + + type: Literal["commit"] = "commit" + +@@ -302,6 +308,7 @@ Commit.iter_items + repo: "Repo", + rev: Union[str, "Commit", "SymbolicReference"], + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator["Commit"]: + R"""Find all commits matching the given criteria. +@@ -329,6 +336,11 @@ Commit.iter_items + if "pretty" in kwargs: + raise ValueError("--pretty cannot be used as parsing expects single sha's only") + # END handle pretty ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=cls.unsafe_git_rev_options ++ ) ++ + + # Use -- in all cases, to prevent possibility of ambiguous arguments. + # See https://github.com/gitpython-developers/GitPython/issues/264. +diff --git a/git/remote.py b/git/remote.py +index f2ecd0f3..cafa1f84 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -1061,7 +1061,10 @@ Remote.fetch + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_fetch_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_fetch_options, ++ ) + + proc = self.repo.git.fetch( + "--", self, *args, as_process=True, with_stdout=False, universal_newlines=False, v=verbose, **kwargs +@@ -1115,7 +1118,10 @@ Remote.pull + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_pull_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_pull_options, ++ ) + + proc = self.repo.git.pull( + "--", self, refspec, with_stdout=False, as_process=True, universal_newlines=False, v=True, **kwargs +@@ -1188,7 +1194,10 @@ Remote.push + Git.check_unsafe_protocols(ref) + + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=self.unsafe_git_push_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_push_options, ++ ) + + proc = self.repo.git.push( + "--", +diff --git a/git/repo/base.py b/git/repo/base.py +index 8059fceb..e9e7aa66 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -159,6 +159,20 @@ class Repo: + ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt + """ ++ unsafe_git_archive_options = [ ++ # Allows arbitrary command execution through the remote git-upload-archive command. ++ "--exec", ++ # Writes output to a caller-controlled filesystem path. ++ "--output", ++ "-o", ++ ] ++ ++ unsafe_git_revision_options = [ ++ # This option allows output to be written to arbitrary files before revision parsing. ++ "--output", ++ "-o", ++ ] ++ + + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") +@@ -743,6 +757,7 @@ Repo.iter_commits + self, + rev: Union[str, Commit, "SymbolicReference", None] = None, + paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Iterator[Commit]: + """An iterator of :class:`~git.objects.commit.Commit` objects representing the +@@ -759,6 +774,9 @@ Repo.iter_commits + :param kwargs: + Arguments to be passed to :manpage:`git-rev-list(1)`. + Common ones are ``max_count`` and ``skip``. ++ :param allow_unsafe_options: ++ Allow unsafe options in the revision argument, like ``--output``. ++ + + :note: + To receive only commits between two named revisions, use the +@@ -770,7 +788,18 @@ Repo.iter_commits + if rev is None: + rev = self.head.commit + +- return Commit.iter_items(self, rev, paths, **kwargs) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) ++ ++ return Commit.iter_items( ++ self, ++ rev, ++ paths, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + + def merge_base(self, *rev: TBD, **kwargs: Any) -> List[Commit]: + R"""Find the closest common ancestor for the given revision +@@ -1035,7 +1064,9 @@ Repo.blame_incremental + # reveal_type(self.head.reference) # => Reference + return self.head.reference + +- def blame_incremental(self, rev: str | HEAD | None, file: str, **kwargs: Any) -> Iterator["BlameEntry"]: ++ def blame_incremental( ++ self, rev: str | HEAD | None, file: str, allow_unsafe_options: bool = False, **kwargs: Any ++ ) -> Iterator["BlameEntry"]: + """Iterator for blame information for the given file at the given revision. + + Unlike :meth:`blame`, this does not return the actual file's contents, only a +@@ -1046,6 +1077,9 @@ Repo.blame_incremental + uncommitted changes. Otherwise, anything successfully parsed by + :manpage:`git-rev-parse(1)` is a valid option. + ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ + :return: + Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the + commit to blame for the line, and range indicates a span of line numbers in +@@ -1055,6 +1089,10 @@ Repo.blame_incremental + a continuous range spanning all line numbers in the file. + """ + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ ) + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) + commits: Dict[bytes, Commit] = {} + +@@ -1132,7 +1170,8 @@ Repo.blame + rev: Union[str, HEAD, None], + file: str, + incremental: bool = False, +- rev_opts: Optional[List[str]] = None, ++ rev_opts: Optional[Sequence[str]] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[List[Commit | List[str | bytes] | None]] | Iterator[BlameEntry] | None: + """The blame information for the given file at the given revision. +@@ -1141,6 +1180,9 @@ Repo.blame + Revision specifier. If ``None``, the blame will include all the latest + uncommitted changes. Otherwise, anything successfully parsed by + :manpage:`git-rev-parse(1)` is a valid option. ++ :param allow_unsafe_options: ++ Allow unsafe options in revision argument, like ``--output``. ++ + + :return: + list: [git.Commit, list: []] +@@ -1151,9 +1193,14 @@ Repo.blame + appearance. + """ + if incremental: +- return self.blame_incremental(rev, file, **kwargs) +- rev_opts = rev_opts or [] +- data: bytes = self.git.blame(rev, *rev_opts, "--", file, p=True, stdout_as_string=False, **kwargs) ++ return self.blame_incremental(rev, file, allow_unsafe_options=allow_unsafe_options, **kwargs) ++ rev_opts_list = list(rev_opts or []) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([rev, rev_opts_list], kwargs), ++ unsafe_options=self.unsafe_git_revision_options, ++ ) ++ data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} + blames: List[List[Commit | List[str | bytes] | None]] = [] + +@@ -1364,7 +1411,10 @@ Repo.clone_from + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(str(url)) + if not allow_unsafe_options: +- Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=cls.unsafe_git_clone_options) ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_clone_options, ++ ) + if not allow_unsafe_options and multi: + Git.check_unsafe_options(options=multi, unsafe_options=cls.unsafe_git_clone_options) + +@@ -1539,6 +1589,8 @@ Repo.archive + ostream: Union[TextIO, BinaryIO], + treeish: Optional[str] = None, + prefix: Optional[str] = None, ++ allow_unsafe_options: bool = False, ++ allow_unsafe_protocols: bool = False, + **kwargs: Any, + ) -> Repo: + """Archive the tree at the given revision. +@@ -1560,6 +1612,12 @@ Repo.archive + * You may specify the special ``path`` keyword, which may either be a + repository-relative path to a directory or file to place into the archive, + or a list or tuple of multiple paths. ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--exec`` or ``--output``. ++ ++ :param allow_unsafe_protocols: ++ Allow unsafe protocols to be used in ``remote``, like ``ext``. ++ + + :raise git.exc.GitCommandError: + If something went wrong. +@@ -1571,6 +1629,14 @@ Repo.archive + treeish = self.head.commit + if prefix and "prefix" not in kwargs: + kwargs["prefix"] = prefix ++ remote = kwargs.get("remote") ++ if not allow_unsafe_protocols and remote is not None: ++ Git.check_unsafe_protocols(str(remote)) ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_archive_options, ++ ) + kwargs["output_stream"] = ostream + path = kwargs.pop("path", []) + path = cast(Union[PathLike, List[PathLike], Tuple[PathLike, ...]], path) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 474206d4ed..72eb073196 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -22,6 +22,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44244_p1.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-67326.patch \ + file://CVE-2026-67323.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103300 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7337.1793976214149599703 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=R9Y+PkW1; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7171; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=dSSe1VBHmKiPBi/yFt4xxsEyCT2xDHF1UBNinPP5rVY=; b=R9Y+PkW1W6lXRvBv762JXcNKFsBsqgb8oxtNVdnDqeedk+ZX1FSpaBSQ XUpGWGfLAU7qg+Gss22TlS9KTVGJJ1K23bUbwWk2i0NXQ2e64ofqUXJD7 WaRl+fAiLSLFjLtW1BzOrw71tQIBB/fipUODCCIzAQ9TVWKpLEcVRhe1v 4blrYz5bpzv6bh2by3ahr38FxqkTeP2G0VebG8hp22dS26JTqx9LahyzI nxlx2p2FMN4iU0dZd1ukr7eXTwo8UCjNshmd6yPqE6Z/47iZlrehvUg8o 2BeQp0aePetGtStgru3sUUQeEIxMcPEq6naYcDJO5R31C9sr/Ss6SpULC A==; X-CSE-ConnectionGUID: APXNeR1ESCKynszTeL/CAA== X-CSE-MsgGUID: MCM3AdIKRzepXtYXrovgbw== X-IPAS-Result: A0BYAACS5u1q/5D/Ja1aHQEBAQEJARIBBQUBgX4GAQsBglZ1YENJA5QngiEDi2WSPIF+DwEBAQ9EDQQBAYQ/RgKOHQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLyALIwgZgwIBgjoDNwMRvEWBeTOBAYMpAT8CQ1DYTA0Db4FoAQsUAYE4AYVBgwCFJF0YAUSEOScbgUlEhH6BBYEaQgEBgSeGfwSDHBKBWoEDjBUCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9giAlTQEsEFEBCiGBVT6UCo9kgiGBNZ5rcYQqjCSPPoV8GjOqcQuYfY4KhAqRMi1ohGmBbwUwgUcLBzMaCBsVO4JnCUoZD445g2uBf4NlxggmMgIGAzIBAQcCBw4DC4FokAACJgeBTwEB IronPort-Data: A9a23:S36Pm6hmC878UJAGHWkex4wFX161NxEKZh0ujC45NGQN5FlHY01je htvXGDQOP/YY2L8e94kbIzg8U0DusCEn4djTVM+qC00QiJjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvre8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUxwtZRDFsX2 MczCyELdQK/isbx65uSH7wEasQLdKEHPasFsX1miDWcBvE8TNWbHOPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgt/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOJI3THZgOxy50o Erj1EGiKx07F+aNxCK17kOcnOjRkinkDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBbCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:74jpoq1fNa40t1qV+ej1HAqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:Z2H6aGubRLih4/ZTywue9m706IsMSk37wU2JDnSTKndvU6+pRHvX04pNxp8= X-Talos-MUID: 9a23:LGzYRwhlHz7ygfnWk5a6HcMpEexNuI2iKWM3g5gei9W1BTZ3JTiXk2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="536910531" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 13F53180003C1 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id AF865CBF203; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 03/27] python3-git: Fix CVE-2026-67325 Date: Fri, 6 Nov 2026 06:43:07 -0800 Message-Id: <20261106144331.3354811-4-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249665 CVE-2026-67325 concerns bypasses using abbreviated long options. Commit [1] introduces rejection of those abbreviations, and [2] refines that check. The CVE description is in [3]. [1] https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f [2] https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-67325 Signed-off-by: Yogita Urade --- Changes in v2: - Kept p1's UnsafeOptionError raise in upstream's multi-line form. - Formatted p2's exact-match UnsafeOptionError raise on one line to match upstream. --- .../python3-git/CVE-2026-67325_p1.patch | 49 +++++++++++++++++ .../python3-git/CVE-2026-67325_p2.patch | 52 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 2 + 3 files changed, 103 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch new file mode 100644 index 0000000000..4c1f3195d9 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch @@ -0,0 +1,49 @@ +From 048f65847761514ebccf3cd8a889fef7a0068c07 Mon Sep 17 00:00:00 2001 +From: abhiprd2000 <8292aniarc@gmail.com> +Date: Thu, 9 Jul 2026 21:22:50 +0530 +Subject: [PATCH] Reject abbreviated forms of unsafe git options + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +(cherry picked from commit 2ab051697940144545a14d2f4a639c6409c3187f) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 87866be2..f8fead70 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -739,13 +739,20 @@ Git.check_unsafe_options + arbitrary commands. These are blocked by default. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. ++ # Git accepts any unambiguous prefix of a long option, so an abbreviated ++ # spelling such as `--upl` for `--upload-pack` must be rejected too. An ++ # option is unsafe if its canonical name is a prefix of any blocked ++ # option's canonical name. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} + for option in options: +- unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option)) +- if unsafe_option is not None: +- raise UnsafeOptionError( +- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." +- ) ++ candidate = cls._canonicalize_option_name(option) ++ if not candidate: ++ continue ++ for canonical, unsafe_option in canonical_unsafe_options.items(): ++ if canonical.startswith(candidate): ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) + + @classmethod + def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]: diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch new file mode 100644 index 0000000000..65a914f0a0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch @@ -0,0 +1,52 @@ +From 6de6760007664e5e9178b98e616d0b9edc959a53 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 13:45:42 +0200 +Subject: [PATCH] Address review feedback about unsafe option abbreviations + +The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs. + +This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected. + +CVE: CVE-2026-67325 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63] + +Backport Changes: +- Omitted test/test_clone.py, test/test_git.py because the current + PyPI source archive does not include the test suite and the + python3-git recipe does not run it. + +Reviewd-by: Sebastian Thiel +(cherry picked from commit 181e8ede7543dbbdcee92756cea260f675316c63) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index cd22aa83..3b97871e 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -742,14 +742,22 @@ Git.check_unsafe_options + # Git accepts any unambiguous prefix of a long option, so an abbreviated + # spelling such as `--upl` for `--upload-pack` must be rejected too. An + # option is unsafe if its canonical name is a prefix of any blocked +- # option's canonical name. ++ # option's canonical name. Only long options and multi-character kwargs ++ # can be abbreviations; single-character short options remain exact-match ++ # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) + if not candidate: + continue ++ unsafe_option = canonical_unsafe_options.get(candidate) ++ if unsafe_option is not None: ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): ++ continue + for canonical, unsafe_option in canonical_unsafe_options.items(): + if canonical.startswith(candidate): + raise UnsafeOptionError( + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 72eb073196..76a21c670f 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -23,6 +23,8 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-44244_p2.patch \ file://CVE-2026-67326.patch \ file://CVE-2026-67323.patch \ + file://CVE-2026-67325_p1.patch \ + file://CVE-2026-67325_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103301 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7521.1793976220823708730 for ; Fri, 06 Nov 2026 06:43:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=CI9sgnQq; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6426; q=dns/txt; s=iport01; t=1793976220; x=1795185820; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=SOhRAgNrTc9u8M2D9k9aQAhDW8BJAdacJb7wFDRCDs0=; b=CI9sgnQqdjw86UjWWTIV8qQVbfQrSju4rpuOzmV8ZNIKNZEUFFVI1rOe RTGDBiVtNoQHBrzVnfjgy8oizKwbiWhA03BvnWkwLepCHApBN6obsij/5 l5WvFu2JMHE2VDcpTcrqBSwGW1Pc5QY2wiwKCr/JHkU6tS1jMW9HHM0jg kKr7avCTV8AoZuDztmgUMrJInTYCI6zc1+xWMrv4Py4JLeOdufTYKdhDj Ht9BYYu5Ey+GtB+sN4V8UHSHD4xQFe3uwX7nyIy+rAOpLqhrG5UswVa2S eIj40IAuF92AE/1zhQS0eNvnp5/soGfCQJfeKzSWpDGvGH+EhkLAEsAGA A==; X-CSE-ConnectionGUID: iF508r/dSZu1/zR1N6CO3w== X-CSE-MsgGUID: tv229FN0SwGWPyJClQRZYA== X-IPAS-Result: A0ACAwAN5+1q/43/Ja1aH4I6gld1YENJA5QngiEDniEUgWoPAQEBD0QNBAEBhD9GAo4dAiY2Bw4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxNgXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAUSEOScbgUlEgRWDaYEFgVwBAYFGhmAEgxwSgVqBA4wVAoFRW4YeSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CRQgzEgEsEFEBCiGCFBildp9TgT6EKowklToaM6pxC5h9jgqVPIEVhGmBbwYvgUcLBzMaCBsVO4JnCUoZD445g2uBf4NlxggmMgIGAwMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:d4Sl7qBmGjHB+xVW/37iw5YqxClBgxIJ4kV8jS/XYbTApDsn02NTn TEbD2DSbP/fYGqgetwkPo7lpkxQ7ZDVyIdrOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEwtszVBEseoEjyPsuRnN0r NpGAxdWcUXW7w626OrTpuhEnM8vKozveYgYoHwllW2fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY2BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOkFAtj+axbYe9ltqiWdsPxBe2g Dr94EvGOgA4H9im8wi02yf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTVluzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ02FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:o8LyMK4oc/0QADRKAgPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:NDORk2lacuyBFZUAV5V64fvYS2bXOXzzkS+AOQi0MlR0EfqHcwa2pohDyNU7zg== X-Talos-MUID: 9a23:q7AUPw8L03bfzimL4OOPlFuQf9t2uf7/JmZVqoophPGVFwd0Ag2vvR3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544476455" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 19EDC180004AF for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id B6D5BCBF204; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 04/27] python3-git: fix CVE-2026-67324 Date: Fri, 6 Nov 2026 06:43:08 -0800 Message-Id: <20261106144331.3354811-5-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249689 Upstream commit [1] adds joined-short-option parsing, including clustered forms such as -fuVALUE, while preserving safe attached values. This behavior matches CVE-2026-67324's description [2] and the upstream advisory [3]. The commit also adjusts clone-option handling to preserve long-option abbreviation checks. [1] https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-67324 [3] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj Signed-off-by: Yogita Urade --- Changes in v2: - Refreshed patch context and removed trailing whitespace. --- .../python/python3-git/CVE-2026-67324.patch | 94 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 95 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch new file mode 100644 index 0000000000..73722344c1 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch @@ -0,0 +1,94 @@ +From b09720b6f8311edac108392bd834e74918836c4f Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 12 Jul 2026 14:12:16 +0200 +Subject: [PATCH] fix: reject joined unsafe short options + +GitPython blocks options such as --upload-pack/-u and --config/-c +because they can execute arbitrary commands unless unsafe options are +explicitly allowed. Git also accepts a short option with its value +joined to the same token, including after clusterable flags. Forms +such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore +bypass an exact-token check. + +Parse single-dash option tokens sufficiently to recognize blocked +short options while preserving safe attached values such as +-oupstream. Also distinguish clone multi-option values from bare +kwargs so positional values are not treated as long-option +abbreviations. + +This completes the option-validation hardening for +GHSA-2f96-g7mh-g2hx. + +CVE: CVE-2026-67324 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285] + +Backport Changes: +- Omitted test/test_clone.py, test/test_git.py, test/test_remote.py + because the current PyPI source archive does not include the test + suite and the python3-git recipe does not run it. + +Reviewed-by: Sebastian Thiel +(cherry picked from commit 56806080c1348749b07daa4a2024ce47b3cad285) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 40 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 523029fc..75495dc1 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -734,8 +734,21 @@ + @classmethod + def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: +- """Check for unsafe options. +- +- Some options that are passed to ``git `` can be used to execute +- arbitrary commands. These are blocked by default. ++ """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. ++ ++ In addition to exact matches, this rejects abbreviated long options accepted ++ by Git (for example, ``--upl`` for ``--upload-pack``) and unsafe short options ++ whose values are joined to the same token, including after clusterable flags ++ (for example, ``-uVALUE`` and ``-fuVALUE``). ++ ++ A list containing only bare names is treated as normalized keyword arguments, ++ so multi-character names such as ``upload_p`` are checked as long-option ++ abbreviations. If any item starts with ``-``, the list is treated as tokenized ++ command-line input: bare items can be option values and are not checked as ++ abbreviations. Thus ``["--origin", "upload"]`` is allowed. Single-dash options ++ use short-option parsing rather than broad prefix matching, preserving safe ++ attached values such as ``-oupstream`` and ``-bcurrent``. ++ ++ Some options passed to ``git `` can execute arbitrary commands and ++ are therefore blocked by default unless the caller explicitly allows them. + """ + # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`. +@@ -747,4 +760,13 @@ + # only. + canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options} ++ unsafe_short_options = { ++ canonical: option ++ for canonical, option in canonical_unsafe_options.items() ++ if option.startswith("-") and not option.startswith("--") and len(canonical) == 1 ++ } ++ # These value-less Git flags can be clustered before another short option ++ # (for example, ``-fuVALUE``). Stop at any other character because it may ++ # begin an attached value, as ``o`` does in the safe option ``-oupstream``. ++ clusterable_short_options = frozenset("46flnqsv") + options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: +@@ -757,3 +779,13 @@ + raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.") ++ option_token = option.split("=", 1)[0].split(None, 1)[0] ++ if option_token.startswith("-") and not option_token.startswith("--"): ++ for option_char in option_token[1:]: ++ unsafe_option = unsafe_short_options.get(option_char) ++ if unsafe_option is not None: ++ raise UnsafeOptionError( ++ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." ++ ) ++ if option_char not in clusterable_short_options: ++ break + if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): + continue diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 76a21c670f..ca2efce37e 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -25,6 +25,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67323.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ + file://CVE-2026-67324.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103288 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7338.1793976214391252784 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=DZKR5wXL; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8338; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=eHR6tmB0Mph+YkiIDc2yzkFIrVec2FD3DVtWbr8Pi30=; b=DZKR5wXLrQgcxkojfnJuXnNuK1ztD5T2YnfydNsCC9Sl8OrQn6Dq2fWD hpXn0vxzRKb+vlAsljQ/bC7X4MyRWKVtElEQbSTIUmT+3nx++KEfyvyxk z02/iIKkB90MK/2al2nM9XyWH14Q+mx9wFAnn/hLcCwkhWLMjwQ/9bxkx o5SpsE4PKRN4hqS9GfRDtCMUIsQGVcHP5yk3kdve0NqXaZsXQKaVKirWi eW1sbgyK/CM78NQbF0P7c293ojviKJElRmBckYv8A8S5X3HRNRd0eQNhf /trbj/sYaNQg0AGVpnCzR0La9vCbotKs4Y62Fx6Rz/mQMm5QdZqQHUdGk Q==; X-CSE-ConnectionGUID: eQeEtGBPT96tA/AcbMKjxg== X-CSE-MsgGUID: LFdf+7vZQsOQ9yHxRsx76A== X-IPAS-Result: A0ACAwAQ5u1q/5H/Ja1aglmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysdAQUIGYMCAYI6AzcDEbw/gXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAUSEOScbgUlEgRWDaYEFgVwCiCYEgxwSgVqNGAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CRTsSPRwbBwQPASuBNA8KMC+TNZJBoRGEKowklToaM4VbpRYLmH2OCpZRhGmBbgE1gVkzGggbFYMiCUoZD445g2uFE1FsxRwmMgIGAwMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:/GjOTK8/IxgY2p7R8KoJDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3z 2cYXDqGM6qOamb1eIskboyyo0NTv5/VndNkHgdt+HxEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpJs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k7BIA15sldOV0fq +AxbxkGZDWghfK5lefTpulE3qzPLeHxN48Z/3UlxjbDALN+EdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0An1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OWxbYKLIYXVH625mG68i G7IvDvnMCgBE+XO2BqVyGm82bHmyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7JQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:NPncG6oRKE8IFs+EzM46mSYaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:5Hk/jmuxugwLmsS6CRw3fwmV6IsoS3Dw0Fj6G3PpV3pAD5SeQ3qz+rNrxp8= X-Talos-MUID: 9a23:13qmCQs8v4qucLfpC82noB9uOoQ3/ZaXE2c0wIQmq/OfJXMuEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545063172" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 67FDC180001F7 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id C07DBCBF21E; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 05/27] python3-git: fix CVE-2026-67322 Date: Fri, 6 Nov 2026 06:43:09 -0800 Message-Id: <20261106144331.3354811-6-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249673 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2 [2] https://security-tracker.debian.org/tracker/CVE-2026-67322 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Converted the caller-supplied URL to str before Git.polish_url(), and converted the normalized clone URL to str before Git.check_unsafe_protocols(). Expanded Backport Changes to explain these GitPython 3.1.43 adaptations. --- .../python/python3-git/CVE-2026-67322.patch | 171 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 172 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch new file mode 100644 index 0000000000..a78d2bd37a --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67322.patch @@ -0,0 +1,171 @@ +From 3ae11b59c9c4cf15f04397d58b8a90b621b6571b Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 15 Jul 2026 16:44:13 +0200 +Subject: [PATCH] fix: prevent environment expansion in clone URLs + +Repo.clone_from() expanded environment-variable references in caller-supplied +URLs before passing them to git clone. This could expose process environment +values to an untrusted remote and made protocol validation apply to a different +value than Git received. + +Polish clone URLs without variable or home expansion on native and Cygwin +Git, then apply unsafe-protocol validation to that exact normalized value. +Preserve the literal URL when normalizing the stored origin after a successful +clone, while retaining the existing Git.polish_url() default for callers +that intentionally normalize local paths. Add regression coverage for +POSIX and Windows variable syntax, Cygwin conversion, stored origins, and +post-normalization protocol validation. + +Git baseline: git clone passes URL arguments through literally; t/t5601-clone.sh +covers the accepted URL forms without shell-style environment expansion. + +Security: GHSA-rwj8-pgh3-r573. + +CVE: CVE-2026-67322 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. +- In Repo.clone_from(), stringify caller-supplied url before Git.polish_url() + because GitPython 3.1.43 accepts PathLike URLs but polish_url() uses string + operations. Stringify normalized clone_url before Git.check_unsafe_protocols() + because its regex expects str; validate the normalized value passed to Git. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 8ac5a30519b6f4af85398b9b9d7064ff4d452da2) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 19 ++++++++++++------- + git/repo/base.py | 7 ++++--- + git/util.py | 15 +++++++++------ + 3 files changed, 25 insertions(+), 16 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 75495dc1..58d219e3 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -670,29 +670,34 @@ Git.polish_url + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Literal[False] = ...) -> str: ... ++ def polish_url(cls, url: str, is_cygwin: Literal[False] = ..., expand_vars: bool = ...) -> str: ... + + @overload + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> str: ... ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> str: ... + + @classmethod +- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> PathLike: ++ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> PathLike: + """Remove any backslashes from URLs to be written in config files. + + Windows might create config files containing paths with backslashes, but git + stops liking them as it will escape the backslashes. Hence we undo the escaping + just to be sure. ++ ++ :param expand_vars: ++ Expand environment variables and an initial ``~``. Disable this for values ++ obtained from an untrusted source, such as remote URLs. + """ + if is_cygwin is None: + is_cygwin = cls.is_cygwin() + + if is_cygwin: +- url = cygpath(url) ++ url = cygpath(url, expand_vars=expand_vars) + else: +- url = os.path.expandvars(url) +- if url.startswith("~"): +- url = os.path.expanduser(url) ++ if expand_vars: ++ url = os.path.expandvars(url) ++ if url.startswith("~"): ++ url = os.path.expanduser(url) + url = url.replace("\\\\", "\\").replace("\\", "/") + return url + +diff --git a/git/repo/base.py b/git/repo/base.py +index 3380e0c5..d661f036 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -1408,8 +1408,9 @@ Repo.clone_from + if multi_options: + multi = shlex.split(" ".join(multi_options)) + ++ clone_url = Git.polish_url(str(url), expand_vars=False) + if not allow_unsafe_protocols: +- Git.check_unsafe_protocols(str(url)) ++ Git.check_unsafe_protocols(str(clone_url)) + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([], kwargs), +@@ -1421,7 +1422,7 @@ Repo.clone_from + proc = git.clone( + multi, + "--", +- Git.polish_url(str(url)), ++ clone_url, + clone_path, + with_extended_output=True, + as_process=True, +@@ -1461,7 +1462,7 @@ Repo.clone_from + # escape the backslashes. Hence we undo the escaping just to be sure. + if repo.remotes: + with repo.remotes[0].config_writer as writer: +- writer.set_value("url", Git.polish_url(repo.remotes[0].url)) ++ writer.set_value("url", Git.polish_url(repo.remotes[0].url, expand_vars=False)) + # END handle remote repo + return repo + +diff --git a/git/util.py b/git/util.py +index 27b239ab..9619937c 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -382,13 +382,13 @@ _cygexpath + return progs + + +-def _cygexpath(drive: Optional[str], path: str) -> str: ++def _cygexpath(drive: Optional[str], path: str, expand_vars: bool = True) -> str: + if osp.isabs(path) and not drive: + # Invoked from `cygpath()` directly with `D:Apps\123`? + # It's an error, leave it alone just slashes) + p = path # convert to str if AnyPath given + else: +- p = path and osp.normpath(osp.expandvars(osp.expanduser(path))) ++ p = path and osp.normpath(osp.expandvars(osp.expanduser(path)) if expand_vars else path) + if osp.isabs(p): + if drive: + # Confusing, maybe a remote system should expand vars. +@@ -416,7 +416,7 @@ cygpath + ) + + +-def cygpath(path: str) -> str: ++def cygpath(path: str, expand_vars: bool = True) -> str: + """Use :meth:`git.cmd.Git.polish_url` instead, that works on any environment.""" + path = str(path) # Ensure is str and not AnyPath. + # Fix to use Paths when 3.5 dropped. Or to be just str if only for URLs? +@@ -424,12 +424,15 @@ cygpath + for regex, parser, recurse in _cygpath_parsers: + match = regex.match(path) + if match: +- path = parser(*match.groups()) ++ if parser is _cygexpath: ++ path = parser(*match.groups(), expand_vars=expand_vars) ++ else: ++ path = parser(*match.groups()) + if recurse: +- path = cygpath(path) ++ path = cygpath(path, expand_vars=expand_vars) + break + else: +- path = _cygexpath(None, path) ++ path = _cygexpath(None, path, expand_vars=expand_vars) + + return path + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index ca2efce37e..fafb9972ef 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -26,6 +26,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67325_p1.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ + file://CVE-2026-67322.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103285 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7337.1793976214149599703 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=cAqyi3+D; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4385; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=RULGvOBQHJDQA6sR5MMmpN6lHG84BWVBm8fc19hPC9s=; b=cAqyi3+DjIJnKowvh0cgDtzS2cu7ZpmpuTNVk4lF6hlDQpX4lJK6UmfX PGN3SypAbS/SKHeWEAchmr7IBM+Rj4MzCm4ZQk9hZkHkhKCtBZBaEMFkD X9bwAU+fxPpsjV6au/UDlS4/AKGIWVlo1n4XyyhBUepTeA88apLVFl9XB 3GlAYHfdnYr2s8DddKLd5//5cMoGJqaeYfeu8lIDY31AjBHmQSlg9KwUX 4RPLAgrFlnERA0gtyn5OBcmrRDPJ/QNkWM9JMGIGL40Dk4WVHYlLhyvwg W1viuCgURNeSahnc+rfG3UvISgq9NEdZiASBHiIPGnrGIY+xPE6G4uqTw A==; X-CSE-ConnectionGUID: sO6QQB3WQBm0SK84tLY4Bw== X-CSE-MsgGUID: ekQC8M0sQ3iMizVdvwZ6JA== X-IPAS-Result: A0BIAgCS5u1q/5H/Ja1aHgEBCxIMggULgld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvEWBeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBhH0nG4FJRIEVg2mBBYFcAogmBIMcEoFaGI0AAoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYJFTT1RAQohRoEaJScikxWQHoIhoRGEKowklToaM4VbpRYLmH2OCpZRhGmBaDyBWTMaCBsVgyIJShkPji0MC4NghRNRxggmMgIJAy8BAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:qD7y66q7ABqkKV9MQMrP030OV+peBmJPZBIvgKrLsJaIsI4StFCzt garIBnTOvbeMTGme94gboiy8UxX7JXcm99nHgFt+Cw2EXgQ8uPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E435ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0v1QX1h33 6cnERoINiug176q5IPnYPY506zPLOGzVG8ekmtrwTecCbMtRorOBv2ao9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVfrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUFJwNwx3Dz o7A12n6OzpKEYSE8GGE13O+uOPRghGleqtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFm4HY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:VdllRKvTuhqi1i/WIWmHv+2z7skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:1y1zpG29P05iIX7xLn47AbxfAed7S0T3l0jpCUrgMkU5FKGxeAO65/Yx X-Talos-MUID: 9a23:XWMGJQZodS1JlOBTujzVr2FHbNxRuKWLCVIznYsZiZemHHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="536910533" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 694BE180005B3 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id D0533CBF234; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 06/27] python3-git: fix CVE-2026-69097 Date: Fri, 6 Nov 2026 06:43:10 -0800 Message-Id: <20261106144331.3354811-7-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249671 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1 [2] https://security-tracker.debian.org/tracker/CVE-2026-69097 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Restored the longer upstream commit explanation and Sebastian Thiel co-author trailer, and corrected the abbreviated upstream/cherry-pick hash to the full commit hash. The source fix is unchanged. --- .../python/python3-git/CVE-2026-69097.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch new file mode 100644 index 0000000000..55b76ece40 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch @@ -0,0 +1,60 @@ +From 1ed1b924f4e2d2ee7bab296df77b978af21853f1 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Mon, 20 Jul 2026 14:13:22 +0200 +Subject: [PATCH] fix: validate config section delimiters + +GHSA-3rp5-jjmw-4wv2 identified that configuration section names could alter the +structure of serialized config despite the existing control-character checks. + +Reject unquoted closing section delimiters across all writer entry points +while preserving valid delimiters inside quoted subsections and the +existing option-name behavior. Add regression coverage for unsafe plain and +quoted-subsection-shaped names as well as a valid quoted subsection. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. Git config parsing +treats an unquoted closing bracket as the end of a basic section header, while +its extended form permits brackets inside a quoted subsection and requires a +final bracket after the closing quote. + +CVE: CVE-2026-69097 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI + source archive does not include the test suite and + the python3-git recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f1) +Signed-off-by: Yogita Urade +--- + git/config.py | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/git/config.py b/git/config.py +index 236de3a6..21f6e8aa 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -875,6 +875,22 @@ GitConfigParser._assure_config_name_safe + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "section" and isinstance(name, str): ++ in_quotes = False ++ escaped = False ++ for index, char in enumerate(name): ++ if escaped: ++ escaped = False ++ elif in_quotes and char == "\\": ++ escaped = True ++ elif char == '"': ++ if not in_quotes and (index == 0 or name[index - 1] not in " \t"): ++ raise ValueError("Git config quoted subsection names must begin after whitespace") ++ in_quotes = not in_quotes ++ elif char == "]" and not in_quotes: ++ raise ValueError("Git config section names must not contain an unquoted closing bracket") ++ if in_quotes: ++ raise ValueError("Git config section names must not contain an unterminated quote") + + + @needs_values diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index fafb9972ef..781ec512cc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -27,6 +27,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67325_p2.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ + file://CVE-2026-69097.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103282 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7338.1793976214391252784 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fVwAgvLI; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3915; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=quOX5xExJnhpag+52bXKkMRvSXEns79UKaRAqAb+skg=; b=fVwAgvLI+SujEWXds7M++2FuxeD/+FvxSQ/LgvvL+FoYaO3rG+NZNtdR +cjbcn14lAwf+zT9qx66dInJ1HDyoGECdqGMlyM/0vJoLdXqfrH4ln9Oy ZIlmChIa6+QhlA6I3z4tfVVdKMvKXFQ+7KZOMIbt4cBX7pQR1vZ6iOYsY 11uhPGykzKy33A9eD2g0QPDwWMLFFyzp5FOTcTTdPoUHGKQ9nugHlXWMy sLnd5WCKhhvKwaP1NFz+SspcxnWniXqOsPIGCbLKW2q8vh34e3l+HOsrb EyWHcusfW8peq26BGnur2oxZ000llkIMGMm7y1ewlAryo/luytVAnpwtP w==; X-CSE-ConnectionGUID: Kt94mkVNSSSUcsLOAEO5cg== X-CSE-MsgGUID: 0uDnVC+HSwCp/yMhSVuT3w== X-IPAS-Result: A0BJAgAQ5u1q/5D/Ja1aH4I6gld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvD+BeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBhH0nG4FJRIEVg2mBBYFcAogmBIINgQ8SgVqBA4IiiXMCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gkVNPVEBK4IsD5MokB6CIaERhCqMJJU6GjOqcQuYfY4KllGEaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUcYIJjICBgMDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:vEFLX6NkqKBleK3vrR3ylsFynXyQoLVcMsEvi/4bfWQNrUol1GRSy DRMX2rQM/3bZzP1Lox1bdjnp0wPuceBm9JrGXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2Msawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj69ZyXR0zPrM+wd1MPGpV0 dsxBRdQZR/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmGS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMHwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVAsiOa2aYWOEjCMbZ1IskCmj SHmxHvSGlYLEdyk9ye5qW3504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvWS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6tV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:xQUQGa1T6On/lqrf2gEQeQqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:b975H2Mt4yqLhO5DezU2qEsXJOYeSUbgx2z0BGaVLjtiR+jA X-Talos-MUID: 9a23:2AtDeA6pT3jKlOAW5LXCJjrRxoww/oioNmtOsa4ZkNHDJAlwAAmAsG+oF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545063173" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 695F0180003C1 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id D77A2CBEF8A; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 07/27] python3-git: fix CVE-2026-73625 Date: Fri, 6 Nov 2026 06:43:11 -0800 Message-Id: <20261106144331.3354811-8-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249669 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453 [2] https://security-tracker.debian.org/tracker/CVE-2026-73625 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Refreshed the embedded hunk context and index hashes. --- .../python/python3-git/CVE-2026-73625.patch | 59 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch new file mode 100644 index 0000000000..8f2638017c --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch @@ -0,0 +1,59 @@ +From ef95f1434023af72deabaf91e7154260d4625271 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:39:00 +0200 +Subject: [PATCH] fix: validate split short-option values + + + +Single-character keyword arguments are transformed into an option token and +a separate value token. The unsafe-option candidate builder only checked the +keyword name, allowing an option-like value to bypass guards shared by clone, +remote, revision, blame, and archive operations. + +Include dash-prefixed values only when short options are actually split, +including sequence values, while preserving bare values and the non-splitting +compatibility path. + +Git baseline a23bace9 defines clone -n and --upload-pack as distinct options, +matching the argv boundary this validation now preserves. + +Refs GHSA-r9mr-m37c-5fr3. + +CVE: CVE-2026-73625 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453] + +Backport Changes: +- Omitted test/test_git.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit e8d0fbf774d1f6baa3b481adfe48bd262e43b453) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/git/cmd.py b/git/cmd.py +index eb7bf055..2ce27290 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -804,11 +804,18 @@ Git._option_candidates + option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-") + ] + if kwargs: ++ split_single_char_options = kwargs.get("split_single_char_options", True) + for key, value in kwargs.items(): + values = value if isinstance(value, (list, tuple)) else (value,) + if any(value is True or (value is not False and value is not None) for value in values): + key = str(key) + options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") ++ if len(key) == 1 and split_single_char_options: ++ options.extend( ++ str(value) ++ for value in values ++ if value is not True and value not in (False, None) and str(value).startswith("-") ++ ) + return options + + class AutoInterrupt: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 781ec512cc..551b47fc39 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -28,6 +28,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67324.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ + file://CVE-2026-73625.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103284 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=dh5KDhZY; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3714; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=9R105VMwMvmqcOaHFu+LaE+QayjkHKo/xA1t/q/Mz9s=; b=dh5KDhZYawqN7s7v/6UrzR3gmMu9FUPwEgHUA7nXKqlI5H46ho90mGU6 ImqkDyKtE+nek/mI72TlY5S1uGJgP673/Qh0Nix+M/OzNTdM+Oaq12PEF 61gI1Bxs0i7HdkvZtBoCYVYkTrVmuSC6USgSY62D6UWM6nDFcZcfUEGuw pCusAtQp2kYVGDdVglLpg2fjsdeZM70mw+VYq0PK9sBTeGkGg/K/61khe ZF1IBlwO8xRtXSvS3G7y6jB7VFpRt+6Oxkip0SKWJ5PdyIYBpXdcFl1+u 3mgWRW0uYaRrfgXV8/Xmfyvy/G8FN1K3U+IydtseuXyr2Pjwo0a3tuI7q g==; X-CSE-ConnectionGUID: oOgIoMmQQ2inMyZwedhbJw== X-CSE-MsgGUID: 1+tLY4hFTPeDmSBxFld+kg== X-IPAS-Result: A0BLAgAN5+1q/4r/Ja1aHgE8DA4LgVmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8TYF5M4EBgykBPwICQAFQ2EwQb4FoAQsUAYE4hUKIJF0YAYR9JxuBSUSBFYNpgQWBXAICiCQEgxwSgVqNGAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CRTsSPRsJLQErgiweBqVSoRGEKowklToaM4VbpRYLmH2OCpZRhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:3LJ//6qJZLki1a/gldsa8yL3FbFeBmJPZBIvgKrLsJaIsI4StFCzt garIBmFOfaOMWH3co1xOdzg8EJVsJ/UxtM2SlRv+XtnH34WpOPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E435ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0uFQDkBJ0 PkhEWoMaDWStf27zLKxaPY506zPLOGzVG8ekmtrwTecCbMtRorOBv2To9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5MWPrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fSFZkMzhbGz o7A1z26HjUraNyx9QKI3neXrP/hmS+4W41HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmcHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:T/6vHaBFbi+qxIflHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:SF/E9Gsz4agouA7VKubIj8rM6IsiVXL8y1LVGnbiCGBMWY+KRFOQ8oF7xp8= X-Talos-MUID: 9a23:O0+ZBQozRBeI6v21qkAez2ghKONZv6SANHgAvZA9kdmqMSAzODjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841886" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 6E9E2180001DC for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id E1911CBEF98; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 08/27] python3-git: fix CVE-2026-73623 Date: Fri, 6 Nov 2026 06:43:12 -0800 Message-Id: <20261106144331.3354811-9-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249670 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97 [2] https://security-tracker.debian.org/tracker/CVE-2026-73623 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Updated the Backport Changes line wrapping and hunk context. --- .../python/python3-git/CVE-2026-73623.patch | 53 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch new file mode 100644 index 0000000000..7cb48e1511 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch @@ -0,0 +1,53 @@ +From 3621c3099fef859e91f9f960707902018a370978 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:43:26 +0200 +Subject: [PATCH] fix: reject unsafe clone templates + + + +Treat git clone --template as unsafe because caller-controlled +templates can install hooks that execute during clone. + +Add regression coverage for both direct option and keyword forms. + +References GHSA-6p8h-3wgx-97gf. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73623 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97] + +Backport Changes: +- Omitted test/test_clone.py because the current PyPI + source archive does not include the test suite and + the python3-git recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit ffcb5359e87619f4fe4a70a4aff5f08c5580ba97) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index d661f036..2776c19e 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -148,6 +148,8 @@ Repo.unsafe_git_clone_options + # Can override configuration variables that execute arbitrary commands: + "--config", + "-c", ++ # Can install hooks that execute during clone: ++ "--template", + ] + """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. + +@@ -158,6 +160,9 @@ Repo.unsafe_git_clone_options + The ``--config``/``-c`` option allows users to override configuration variables like + ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt ++ ++ The ``--template`` option can install hooks that execute during clone: ++ https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory + """ + unsafe_git_archive_options = [ + # Allows arbitrary command execution through the remote git-upload-archive command. diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 551b47fc39..d996d4f9f5 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -29,6 +29,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-67322.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ + file://CVE-2026-73623.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103291 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7337.1793976214149599703 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Q3qGImZJ; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7149; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=2viqve1DyQqAm+BV0EXn6wa5DWzG5h5bksIKXjFBrL0=; b=Q3qGImZJBwL6yOu2CKqmqzvHkRPacLSc7b02c46bJbbByZFUh/HkrFyV f97dwE88ngHZRtD9HD8yDk1v577DNIV7/sSCjcJrzKJDYH4uB5Dp1nUxk vwNodNbvSKgq1gY0uJYq6CIjDhXLKcVSU1CTJ0ls+mooF2TpvnqLnokX9 M1mE5mRkdf/8Sb4V1gsaCP8iQGyvUaRrzrlIuL/ZHEF+6igxQXAVYbSg7 Xwt3O6H2ahE91fYuSw/SeO6/AC6BOBp05dMpjtEk7NC1QZv+XqVsELQcN kgHh69e+ez0lUhuTihht4lDSF54RTjBy8H+AU/WEIUamrk5uX6BbEvu8r A==; X-CSE-ConnectionGUID: tjZbPEjhTuO6Br4x4MXF6A== X-CSE-MsgGUID: 8Vm/RIx1S12mCMOKcu9eSg== X-IPAS-Result: A0BIAgCS5u1q/5D/Ja1aHgEBCxIMggULgld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvEWBeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBgxqBYycbgUlEgRWDaYEFgVwCiCYEgxwSgVqBA4U9hlgCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gh8mTTEMPhMBK4IsJCcDkmiSQKERhCqMJJU6GjOEBIFXkkKSVAuYfY4KllGEaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:52iIHqOlLpjSgffvrR3ylsFynXyQoLVcMsEvi/4bfWQNrUp01mYPm jEXCD3XOveJMWv9LYhzYY6/8RsE78WEyIRnQHM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2Msawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+lsPksOEI8YxvtQX0tUq exEDQAjMDnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmGS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMHwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVcvgeG1bYGJEjCMbZVrmwGih 3KfxD2jBzo/E/+U1GuIyX3504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvWS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6tV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:qJUCaaGEZDPNBV7FpLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:hwQjFW/eOWTkmkJFYc+Vv1IWKModX3/d8Gr3fWWiVXY1bY27F3bFrQ== X-Talos-MUID: 9a23:pdyqegxYRKr4rP42kl76OllmaquaqPSQDQc3sIVfgJDeMAdVHBSWkWW6eYByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="536910534" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 7328B180003EE for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id E9529CBEFAB; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 09/27] python3-git: fix CVE-2026-73624 Date: Fri, 6 Nov 2026 06:43:13 -0800 Message-Id: <20261106144331.3354811-10-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249676 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6 [2] https://security-tracker.debian.org/tracker/CVE-2026-73624 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Cleaned whitespace in the Backport Changes note. --- .../python/python3-git/CVE-2026-73624.patch | 139 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 140 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch new file mode 100644 index 0000000000..9db29de43d --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch @@ -0,0 +1,139 @@ +From 285d6227b9132ed6bab3cc28665e87b2285757ae Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 04:46:13 +0200 +Subject: [PATCH] fix: guard diff output options + + + +Reject unsafe diff options before revision parsing or Git invocation so +callers cannot write command output to arbitrary filesystem paths. + +Cover commit and index diffs, including option-like revisions, and +preserve an explicit allow_unsafe_options escape hatch. + +References GHSA-fjr4-x663-mwxc. +Validated against Git baseline a23bace9. + +CVE: CVE-2026-73624 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6] + +Backport Changes: +- Omitted test/test_diff.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 1d51b891d7f236044a6aa17498ec682b63dad6e6) +Signed-off-by: Yogita Urade +--- + git/diff.py | 14 ++++++++++++-- + git/index/base.py | 18 ++++++++++++++++-- + 2 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index f89b12d9..9a1f107b 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -9,7 +9,7 @@ import enum + import re + import warnings + +-from git.cmd import handle_process_output ++from git.cmd import Git, handle_process_output + from git.compat import defenc + from git.objects.blob import Blob + from git.objects.util import mode_str_to_int +@@ -34,7 +34,6 @@ from git.types import Literal, PathLike + if TYPE_CHECKING: + from subprocess import Popen + +- from git.cmd import Git + from git.objects.base import IndexObject + from git.objects.commit import Commit + from git.objects.tree import Tree +@@ -186,6 +185,7 @@ class Diffable: + other: Union[DiffConstants, "Tree", "Commit", str, None] = INDEX, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "DiffIndex": + """Create diffs between two items being trees, trees and index or an index and +@@ -215,6 +215,10 @@ class Diffable: + applied makes the self to other. Patches are somewhat costly as blobs have + to be read and diffed. + ++ :param allow_unsafe_options: ++ If ``True``, allow options such as ``--output`` that can write to arbitrary ++ filesystem paths. ++ + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to + swap both sides of the diff. +@@ -227,6 +231,12 @@ class Diffable: + an instance of :class:`~git.objects.tree.Tree` or + :class:`~git.objects.commit.Commit`, or a git command error will occur. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) ++ + args: List[Union[PathLike, Diffable]] = [] + args.append("--abbrev=40") # We need full shas. + args.append("--full-index") # Get full index paths, not only filenames. +diff --git a/git/index/base.py b/git/index/base.py +index b8161ea5..dfe7e0dc 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -23,6 +23,7 @@ from gitdb.base import IStream + from gitdb.db import MemoryDB + + from git.compat import defenc, force_bytes ++from git.cmd import Git + import git.diff as git_diff + from git.exc import CheckoutError, GitCommandError, GitError, InvalidGitRepositoryError + from git.objects import Blob, Commit, Object, Submodule, Tree +@@ -1477,6 +1478,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + ] = git_diff.INDEX, + paths: Union[PathLike, List[PathLike], Tuple[PathLike, ...], None] = None, + create_patch: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> git_diff.DiffIndex: + """Diff this index against the working copy or a :class:`~git.objects.tree.Tree` +@@ -1489,6 +1491,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + Will only work with indices that represent the default git index as they + have not been initialized with a stream. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([other], kwargs), ++ unsafe_options=self.repo.unsafe_git_revision_options, ++ ) ++ + # Only run if we are the default repository index. + if self._file_path != self._index_path(): + raise AssertionError("Cannot call %r on indices that do not represent the default git index" % self.diff()) +@@ -1507,7 +1515,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + # Invert the existing R flag. + cur_val = kwargs.get("R", False) + kwargs["R"] = not cur_val +- return other.diff(self.INDEX, paths, create_patch, **kwargs) ++ return other.diff( ++ self.INDEX, ++ paths, ++ create_patch, ++ allow_unsafe_options=allow_unsafe_options, ++ **kwargs, ++ ) + # END diff against other item handling + + # If other is not None here, something is wrong. +@@ -1515,4 +1529,4 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable): + raise ValueError("other must be None, Diffable.INDEX, a Tree or Commit, was %r" % other) + + # Diff against working copy - can be handled by superclass natively. +- return super().diff(other, paths, create_patch, **kwargs) ++ return super().diff(other, paths, create_patch, allow_unsafe_options=allow_unsafe_options, **kwargs) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index d996d4f9f5..847bdfeab2 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -30,6 +30,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-69097.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ + file://CVE-2026-73624.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103276 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7519.1793976214351860561 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=PF3hqeEP; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4156; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=hI5OHc9H9/CpMJjGmXRIIZ2x36D0UfmQX2jesPli3MY=; b=PF3hqeEP0O/x+ld4fVoihbHmEXjXgcLv3l2c1iYoUvOQ5Kg1cR6bUPpm 2hXCRPtVq4kL190Mck2PbCQ0ixI3Mpjz+9zLKDxNxuY9crllIbTbePuzw nRB9dJZQJ/YYfPKwjYKRlh1xDWWkpXdCHGxqr4T8S2PsQ8qtlZPNiMdtA 6b0yRa4Fy+2mKSKMRiCCBfAqI7Y8GEI6/q3SkgwnZB9qEpuEMEe/Ffor6 B2RgMYauFRWyfg7wRppyxpHKz2cyOr0pzZEDqHS0/tUsBnBEmZ75wfIL3 p0AK8zbArPJA0b6VJDsNiSe2eSSAeFOMwvUqPvZRrwht/7q8w2VTbizAo w==; X-CSE-ConnectionGUID: 0S+xYF4lRliPP2SdFsCxcQ== X-CSE-MsgGUID: g18/uSD/RKySU4/jaUPgTw== X-IPAS-Result: A0BIAgCS5u1q/4//Ja1aHgEBCxIMggULgld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDMgEYAT0cAwECLysjCBmDAgGCOgM3AxG8RYIsgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAYR9JxuBSUSEfoEFgTIqAogmBIMcEoFajRgCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gkU7Ej1RASuBQwpfIhiSfZAegiGhEYQqjCSHJ44TGjOFW6UWC5h9jgqVZRxQhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:yOEISq8VhIHhaUAMXaOBDrUD13+TJUtcMsCJ2f8bNWPcYEJGY0x3m DEaUWuDPayKN2LzKtslYdzg8B4PvsODn9E3G1BvqCpEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpJs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2luBs4Iy8grBVtK9 MQgcgsBQAuol+mPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+H9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Yn1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OWxbYSNJoXaHa25mG6X/ zKB4l/VRSs5JeeilX2H+0+UidPQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7HQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:Dqq8Oq24fZ+10gBq5eLqrAqjBJ4kLtp133Aq2lEZdPUzSL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:CZeQk2nQ5hm3ltwXcec8G57dHijXOSXmj2fhDRO8M2JocIXPclO+44h0mPM7zg== X-Talos-MUID: 9a23:uNTPdAw32695vLQ0dAakstNgk2eaqKv3WAcQqrlBgeqVDhEsfDWUsQy4fpByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545604180" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id 7886B18000385 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id F0BEDCBEFBF; Fri, 6 Nov 2026 06:43:32 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 10/27] python3-git: fix CVE-2026-73622 Date: Fri, 6 Nov 2026 06:43:14 -0800 Message-Id: <20261106144331.3354811-11-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249667 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162 [2] https://security-tracker.debian.org/tracker/CVE-2026-73622 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Cleaned whitespace in the Backport Changes note. --- .../python/python3-git/CVE-2026-73622.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch new file mode 100644 index 0000000000..a9a31c4f4d --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch @@ -0,0 +1,60 @@ +From 5043b75a697c0f9110d2014234831dd1bc568a60 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Wed, 22 Jul 2026 15:42:44 +0200 +Subject: [PATCH] fix: prevent environment expansion in remote URLs + +Remote and submodule creation expanded environment-variable references in +caller-supplied URLs before storing them in Git configuration. This could +expose process environment values through a later network request or a tracked +.gitmodules file. + +Preserve variables literally in the remaining untrusted URL callers while +retaining Git.polish_url() expansion for intentional local-path normalization. +Add regression tests covering remote configuration and submodule configuration. + +Git baseline: git remote add and git submodule add accept URL arguments +literally; Git does not perform shell-style environment expansion on those +arguments. + +CVE: CVE-2026-73622 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162] + +Backport Changes: +- Omitted test/test_remote.py, test/test_submodule.py because the current + PyPI source archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 863417457a0633db7ea5aed4fd01e0b291a41162) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + git/remote.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index fa60bcda..43e0ec9a 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -601,7 +601,7 @@ class Submodule(IndexObject, TraversableIterableObj): + # END verify url + + ## See #525 for ensuring git URLs in config-files are valid under Windows. +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + + # It's important to add the URL to the parent config, to let `git submodule` know. + # Otherwise there is a '-' character in front of the submodule listing: +diff --git a/git/remote.py b/git/remote.py +index cafa1f84..dd892fdc 100644 +--- a/git/remote.py ++++ b/git/remote.py +@@ -805,7 +805,7 @@ class Remote(LazyMixin, IterableObj): + """ + scmd = "add" + kwargs["insert_kwargs_after"] = scmd +- url = Git.polish_url(url) ++ url = Git.polish_url(url, expand_vars=False) + if not allow_unsafe_protocols: + Git.check_unsafe_protocols(url) + repo.git.remote(scmd, "--", name, url, **kwargs) diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 847bdfeab2..6456031620 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -31,6 +31,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73625.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ + file://CVE-2026-73622.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103281 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7518.1793976213994639424 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VrJBu0kt; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4451; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=80D9DbwH+lzgJpiUaNtYWzeAGG15okqQnhVYTsoEPJY=; b=VrJBu0ktSyqpCXWpY5porOU5obqEC4ysCDNnUl9GhI5oxpye/G66dcoi Tw3OFSWYGTSlDuZi9zrA1egZUQrkIg84/EGgl/hphcDv0tAqfN21PGYJ3 7XKJa68EpdAeArB9UVo8MUfW9y1XmPLB4/mbmF/fESIQwSOu2Y4QAvyYj WOHeefF9obmWTryosb++w/iEXrcHLAJWCYUVU7I7o87QXngNF0CNREi1z doQ/+WgyyNn2UuD0w+uMbyVq5Hcg33YV37FgdAvF+f7cAAlPmyMlGxfVI RgSZZu5pQFzHJ5SwkYPvKODyxmn0jvXolobsn1kvF1ln23oE5Bm8CXMHg A==; X-CSE-ConnectionGUID: 6LtodBHcQX6KAXby8jaDnA== X-CSE-MsgGUID: C234mXymT7uQPNQpzRLfNQ== X-IPAS-Result: A0BJAgAQ5u1q/5D/Ja1aH4I6gld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvD+BeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBhH0nG4FJRIEVg2mBBYFcAoEnhn8Egg2BDxKBWoEDgiKJcwKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CHyZGBz1RARAbBIEBgScPpWehEYQqjCSVOhozhVulFguYfY4KlWgcTYRpgWg8gVkzGggbFTuCZwlKGQ+OLgsLg2CFE1FsxRwmMgIJAy8BAQcCBw4DC4FokAACJgeBTwEB IronPort-Data: A9a23:+xPX76PmW/Ro+kTvrR3ylsFynXyQoLVcMsEvi/4bfWQNrUomhGZSz WcWWm2Ca/uIYGL2f9h0bd7jp0tT78PUndRkGnM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2Msawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj66tKEEY6F60Tw9YpIkh+/ +1IKjkhaDnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmGS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMHwsYDUXUrsTIIMjhu6ki1H0ciZTrxSeoq9fD237kVAsieG8a4uLEjCMbe4PxRqdl nPDwzvkOyk8DcSN8x6L1Ev504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvWS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:/Ar506vqGNxG5oNFwGi/p2Gl7skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:t5LFImu1TJazt/pfXa0hm8ZQ6It7VmHawF3wKHaIV0VAeLeEGV2Z1KVNxp8= X-Talos-MUID: 9a23:GUKm1gxqPtVUEqBwXVCCRa0VDmeaqI/0UxwIoYQDh5aZDBRWAi+PthC5ZLZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545119396" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 781CE180003FC for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 04029CBEF6B; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 11/27] python3-git: fix CVE-2026-73621 Date: Fri, 6 Nov 2026 06:43:15 -0800 Message-Id: <20261106144331.3354811-12-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249668 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2 [2] https://security-tracker.debian.org/tracker/CVE-2026-73621 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Cleaned whitespace in the Backport Changes note. --- .../python/python3-git/CVE-2026-73621.patch | 72 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch new file mode 100644 index 0000000000..49cdb257d0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch @@ -0,0 +1,72 @@ +From 3186ded297a9818f887c3de47fc2f0aba6a8b298 Mon Sep 17 00:00:00 2001 +From: Sebastian Thiel +Date: Sat, 25 Jul 2026 06:27:01 +0200 +Subject: [PATCH] fix: reject unsafe output options in Commit.count + + + +Commit.count forwards keyword arguments to git rev-list but did not apply the +unsafe-option validation used by the sibling revision APIs. + +Validate forwarded options with the existing Git.check_unsafe_options helper +and retain the explicit allow_unsafe_options escape hatch. This covers +GHSA-p538-c434-8v24 without adding another option parser. + +Git baseline: git.git a23bace963 defines --output as a shared diff option +consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option +with rev-list. + +CVE: CVE-2026-73621 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2] + +Backport Changes: +- Omitted test/test_commit.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: GPT 5.6 +(cherry picked from commit 38553b6fddc7f6a667cdb45a6762343a08fc72b2) +Signed-off-by: Yogita Urade +--- + git/objects/commit.py | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/git/objects/commit.py b/git/objects/commit.py +index cc85e7dd..549e12c7 100644 +--- a/git/objects/commit.py ++++ b/git/objects/commit.py +@@ -269,13 +269,21 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + else: + return self.message.split(b"\n", 1)[0] + +- def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int: ++ def count( ++ self, ++ paths: Union[PathLike, Sequence[PathLike]] = "", ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> int: + """Count the number of commits reachable from this commit. + + :param paths: + An optional path or a list of paths restricting the return value to commits + actually containing the paths. + ++ :param allow_unsafe_options: ++ Allow unsafe options, like ``--output``. ++ + :param kwargs: + Additional options to be passed to :manpage:`git-rev-list(1)`. They must not + alter the output style of the command, or parsing will yield incorrect +@@ -284,6 +292,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable): + :return: + An int defining the number of reachable commits + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options ++ ) ++ + # Yes, it makes a difference whether empty paths are given or not in our case as + # the empty paths version will ignore merge commits for some reason. + if paths: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 6456031620..f712a0e699 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -32,6 +32,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73623.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ + file://CVE-2026-73621.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103298 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7336.1793976213937852288 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Wx6pwb40; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6233; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=V3pm0xUnOLiVIPn9WKikhWH3uH7i0XXZaLWvYHRHAo0=; b=Wx6pwb40E4iPci3TO97CbH64gg6IQMswYWkcT6V315hm0puIQVo7oyvu CsrWphzNcJKFurMpvJwSC6MaZTVgOW/IlLLZb0JFK/B4MLlDhLr6BbaAk 9STsaGC4kAcpQ997w8bdfIxQP2hnlxWGZOzF/riMU527PmxhMjajDfFsH GofSXBWgKU7cXRtFIwg1oCyfkp1cXLkGnCr/VNHfG3DoHd9Kx0rlC1DMo qYWr6uV3qWh0oMWeG4Rn/6Fg84IgQWxWFlEMuz4jkd9/h/xSfO29UFDXm 66Ix8nrKEYFhM5Pi+y8kUJ2kceOFv7RU3UNTJD7xVvErVo/zdDWoFTf4h w==; X-CSE-ConnectionGUID: xTapc1RlTSqP6r/ieZ1jMg== X-CSE-MsgGUID: uB7L5COQQ7CT9igDGqz4Ig== X-IPAS-Result: A0BJAgAQ5u1q/5P/Ja1aglmCV3VgQ0kDlCeCIQOTIIsBgX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbw/gXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAYR9JxuBSUSBFYNpgQWBXAKIJgSCDYEPEoFajRgCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gh8mLQ4SATxRARAbgiwGSJJxMpIFgTWfXIQqjCSVOhozhASBV5JCklQLmH2OCpZRhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:SvxZ/qBhanXufBVW/37iw5YqxClBgxIJ4kV8jS/XYbTApG8q0jYEm GBNCmCFM/aCa2fwcoglO4nk8ElUup/RnYViOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE08lnFEpvB4kkwf9PX3sJ9 PEqcTIoYUXW7w626OrTpuhEnM8vKozveYgYoHwllGmfBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYwBPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOkFEqgOaxaoK9ltqiWO8Kuhuzg Vv/oE/FUxAVGPOG22ak/Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTUkuzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ22FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:560lsaqIqJ3g2/yNp/TKnx4aV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:jFiDUWAyT5tHeGD6Ezlb/VYfQ/ohTkbE9CnKZE61Oz9rbbLAHA== X-Talos-MUID: 9a23:DXC/pQmxw+umF2c5mM2Ednp/HphMvo+JMXlSuqlXusaoGjViZxaS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386420" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 7AC9318000890 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 0B3B1CBEF6C; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 12/27] python3-git: fix CVE-2026-73620 Date: Fri, 6 Nov 2026 06:43:16 -0800 Message-Id: <20261106144331.3354811-13-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249666 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c [2] https://security-tracker.debian.org/tracker/CVE-2026-73620 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Refreshed the embedded hunk context and index hashes. --- .../python/python3-git/CVE-2026-73620.patch | 130 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 131 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch new file mode 100644 index 0000000000..7901c8d28d --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch @@ -0,0 +1,130 @@ +From cc80ea13457773907fa7843e274dca8dc7d196a5 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 05:54:27 +0200 +Subject: [PATCH] Block unsafe checkout-index and tag file options + +GHSA-3f7w-8rr8-f37f reports that caller-controlled options forwarded by +IndexFile.checkout() and TagReference.create() can make Git write to or read +from arbitrary filesystem paths. + +Add regression coverage proving the unsafe options are rejected by default while +preserving the explicit allow_unsafe_options escape hatch. Reuse GitPython's +existing option candidate normalization and unsafe-option guard at both public +API boundaries. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-checkout-index.adoc defines --prefix as prepending an output +path, and Documentation/git-tag.adoc defines -F/--file as reading a tag message +from a file. + +CVE: CVE-2026-73620 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c] + +Backport Changes: +- Omitted test/test_index.py, test/test_refs.py because the current PyPI + source archive does not include the test suite and the python3-git + recipe does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 3af0c2516c5e18c829da30338614688f6b69b49c) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 12 ++++++++++++ + git/refs/tag.py | 13 +++++++++++++ + 2 files changed, 25 insertions(+) + +diff --git a/git/index/base.py b/git/index/base.py +index dfe7e0dc..90d4c16f 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -129,6 +129,8 @@ IndexFile + Make sure you use :meth:`index.write() ` once you are done manipulating the + index directly before operating on it using the git command. + """ ++ unsafe_git_checkout_index_options = ["--prefix"] ++ + + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") + +@@ -1199,6 +1201,7 @@ IndexFile.checkout + paths: Union[None, Iterable[PathLike]] = None, + force: bool = False, + fprogress: Callable = lambda *args: None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> Union[None, Iterator[PathLike], Sequence[PathLike]]: + """Check out the given paths or all files from the version known to the index +@@ -1224,6 +1227,9 @@ IndexFile.checkout + The provided progress information will contain ``None`` as path and item if + no explicit paths are given. Otherwise progress information will be send + prior and after a file has been checked out. ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--prefix``. ++ + + :param kwargs: + Additional arguments to be passed to :manpage:`git-checkout-index(1)`. +@@ -1248,6 +1254,12 @@ IndexFile.checkout + i.e. if you want :manpage:`git-checkout(1)`-like behaviour, use + ``head.checkout`` instead of ``index.checkout``. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=self.unsafe_git_checkout_index_options, ++ ) ++ + args = ["--index"] + if force: + args.append("--force") +diff --git a/git/refs/tag.py b/git/refs/tag.py +index 1e38663a..487eaa14 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -14,6 +14,7 @@ module imports + + # typing ------------------------------------------------------------------ + ++from git.cmd import Git + from typing import Any, TYPE_CHECKING, Type, Union + + from git.types import AnyGitObject, PathLike +@@ -40,6 +41,8 @@ TagReference + print(tagref.tag.message) + """ + ++ unsafe_git_tag_options = ["--file", "-F"] ++ + __slots__ = () + + _common_default = "tags" +@@ -92,6 +95,7 @@ TagReference.create + reference: Union[str, "SymbolicReference"] = "HEAD", + logmsg: Union[str, None] = None, + force: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "TagReference": + """Create a new tag reference. +@@ -121,12 +125,21 @@ TagReference.create + :param force: + If ``True``, force creation of a tag even though that tag already exists. + ++ :param allow_unsafe_options: ++ Allow unsafe options, such as ``--file``. ++ + :param kwargs: + Additional keyword arguments to be passed to :manpage:`git-tag(1)`. + + :return: + A new :class:`TagReference`. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_tag_options, ++ ) ++ + if "ref" in kwargs and kwargs["ref"]: + reference = kwargs["ref"] + diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index f712a0e699..d47ce73d72 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -33,6 +33,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73624.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ + file://CVE-2026-73620.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103279 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=U2w76X8X; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6401; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=1Vt1VYGcPL91BN9pjY7HrCQHVEvwlWZ+is/1ySmRMmU=; b=U2w76X8X2cE0M+UULK+s2HkmG03BBuHVgYuWaGA2QMt2x40x+RdvEJ4g 5ssvBIBavODsSeCG8m6iEfxjkZFyqrhTHtMdjkc1FgeEc/3BMiW/untEG QxBQYqARs3tcrg/eNQuUMfswPVTZhUnD/lq+qzrMHQZs/z3MpUM6+qAq4 3UPndE4rZy0Z7MMCzLePFRBCuAyZnXvbXWEFuqp4e952TXciHzkJdvTJi fF2rT8w/cNx02th61m06nD5mI0xu2Yr2XlIg9XVBcGtpC41LkyfICN+1/ ZDUCmAf8p5bnET7xXF04bZBo/+idTXBWqNCn5iKSLuVvP3pzSWzvgYpkz g==; X-CSE-ConnectionGUID: XxME6hARTSm8uAsZoies8A== X-CSE-MsgGUID: EzLloPgLS9OsiYpbz7GAdw== X-IPAS-Result: A0AaAAAN5+1q/4r/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJA4RUiBuHOIIhA54hgX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMPARgBPRwDAQIDAiYCAisjCBmDAgGCOgM3AxG8TXqBMoEBgykBPwICQAFQ2EwQb4FoAQsUAYEKLgGFQYMgAYUDXRgBhH0nG4FJRIEVg2mBBYFcAgKFOoJqBIMcEoFagQOMFQKBUYZ5SIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD0BbgeSPYIfASUtDhI9JCsCASuCExkepVihEYQqjCSVOhozhVulFguYfY4KlTWBHIRpgWg8gVkzGggbFYMiCUoZD445g2uFE1HGCCYyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:Qq3/xKnLxIjMBDo9cV9W3TPo5gzWJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIfD2DSb/aDYWege4oka42xpEMB7JSDn4VlTVRkqSFgRFtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05Fb0I38spAUh0y ccdeC0kdSKEhu+tkJvuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiaBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaj/7C7pm9AusrmjiaTRUpXqepLE85C7YywkZPL3FbYGNKoDTFZUK9qqej k/U22D+Oh4+D4240ju06ni+2cDmkTyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjFCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rd94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:U2qZDa8RBYPhnf7hLFFuk+D6I+orL9Y04lQ7vn2ZLiYlFfBw9v re+MjzuiWbtN98YhwdcJW7Scq9qBDnhPtICPcqXItKNTOO0ADDEGgh1/qB/9SKIULDH4BmuZ uIC5IfNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYKcemvAJsQlzuQzW2gYzRLeDU= X-Talos-CUID: 9a23:g87vpWlYCFNzje/efoODN5JH9MjXOU3N6VqOI2aCNV1sGKC8Um2X+a5/w+M7zg== X-Talos-MUID: 9a23:YCHZkg04+GiDvITsqchTd29hnDUjzraKDEc1nrE96u6fNB1oMSXCox27Xdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841887" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 7DE6718000280 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 12565CBEF6D; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 13/27] python3-git: fix CVE-2026-73619 Date: Fri, 6 Nov 2026 06:43:17 -0800 Message-Id: <20261106144331.3354811-14-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249688 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca [2] https://github.com/gitpython-developers/GitPython/commit/52199b39ce02c6e8f9fb49e95628b59deebf44c0 [3] https://security-tracker.debian.org/tracker/CVE-2026-73619 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Split the patch into p1 and p2 and updated SRC_URI to apply them in order. P1 adds the unsafe clone and archive options; p2 clarifies the --bundle-uri risk and its effect on Git’s URI access. --- .../python3-git/CVE-2026-73619_p1.patch | 58 +++++++++++++++++++ .../python3-git/CVE-2026-73619_p2.patch | 43 ++++++++++++++ .../python/python3-git_3.1.43.bb | 2 + 3 files changed, 103 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73619_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch new file mode 100644 index 0000000000..0f8541216c --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch @@ -0,0 +1,58 @@ +From 91f2b27eb8976ef5c663f1a0ea8180e2cf28cb10 Mon Sep 17 00:00:00 2001 +From: "GPT 5.6" +Date: Sun, 26 Jul 2026 06:00:59 +0200 +Subject: [PATCH] Block unsafe archive additions and bundle URI + +GHSA-539m-9xh6-q6rr reports incomplete unsafe option lists for archive inputs +and clone bundle URLs. Caller-controlled archive additions can expose or inject +filesystem content, while clone --bundle-uri can dereference an additional +caller-controlled URL. + +Extend the existing archive denylist with --add-file and --add-virtual-file, +and the clone denylist with --bundle-uri. Regression coverage exercises archive +kwargs plus both clone multi-option and keyword paths. + +Git baseline: a23bace963d508bd96983cc637131392d3face18. +Documentation/git-archive.adoc defines --add-file/--add-virtual-file, and +Documentation/git-clone.adoc defines --bundle-uri as fetching from the supplied +URI. + +CVE: CVE-2026-73619 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca] + +Backport Changes: +- Omitted test/test_clone.py, test/test_repo.py because the current PyPI + source archive does not include the test suite and the python3-git recipe + does not run it. + +Co-authored-by: Sebastian Thiel +(cherry picked from commit 7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 2776c19e..4b783586 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -150,6 +150,8 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", ++ # Fetches from a caller-controlled URL: ++ "--bundle-uri", + ] + """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. + +@@ -171,6 +173,10 @@ class Repo: + # Writes output to a caller-controlled filesystem path. + "--output", + "-o", ++ # Reads from a caller-controlled filesystem path: ++ "--add-file", ++ # Injects a caller-controlled path and contents: ++ "--add-virtual-file", + ] + + unsafe_git_revision_options = [ diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p2.patch new file mode 100644 index 0000000000..70d28217ec --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73619_p2.patch @@ -0,0 +1,43 @@ +From 52199b39ce02c6e8f9fb49e95628b59deebf44c0 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 26 Jul 2026 08:56:06 +0200 +Subject: [PATCH] address review comments + +CVE: CVE-2026-73619 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/52199b39ce02c6e8f9fb49e95628b59deebf44c0] + +(cherry picked from commit 52199b39ce02c6e8f9fb49e95628b59deebf44c0) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 93d1725..6594101 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -150,10 +150,10 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", +- # Fetches from a caller-controlled URL: ++ # Fetches from an additional caller-controlled URI: + "--bundle-uri", + ] +- """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed. ++ """Options to :manpage:`git-clone(1)` that permit unsafe command execution or I/O. + + The ``--upload-pack``/``-u`` option allows users to execute arbitrary commands + directly: +@@ -165,6 +165,11 @@ class Repo: + + The ``--template`` option can install hooks that execute during clone: + https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory ++ ++ The ``--bundle-uri`` option fetches from an additional URI before fetching from the ++ clone URL. An untrusted value can therefore make Git access local files or ++ unintended network resources: ++ https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---bundle-uriuri + """ + unsafe_git_archive_options = [ + # Allows arbitrary command execution through the remote git-upload-archive command. diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index d47ce73d72..f0ffb70df8 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -34,6 +34,8 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73622.patch \ file://CVE-2026-73621.patch \ file://CVE-2026-73620.patch \ + file://CVE-2026-73619_p1.patch \ + file://CVE-2026-73619_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103287 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7336.1793976213937852288 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bCV49v5w; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4548; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=RugXnkXrW4GLDEw+tyOzo6qNZRmVTArUrbvvcXyaY1s=; b=bCV49v5wJzFeTg4e6kjLQhSBTCwfd0CxYtTx4Vi3m2z9bJlsPFik3a0A lGk1OgpnZj+YxdYGosURbuiOCzGDuGj6Jqo1Q5lQdCG46cpafIaxq36/O XgwTfw+DYujNHq1TTMcrJkCa170i6J1pO1xt0hktbnVTqukuP6Tkpc7sW DL3/gJnubUCCOsL7EeC8sQtzJCOubW764SW85EQYVQefk9dSJ9jW1zfvO ajFmHFG6pNeroUQF+JwHmkUil4auxzWN5Z/Qe5v58Q6X/XRBd2L8VG+up L/0blMEruhtcpTX4J+SLEskZ67sW8kfXwAJQQlaohymMW5olEkcdjeKnF g==; X-CSE-ConnectionGUID: swpN3f4WTCGLhidJRHOuVQ== X-CSE-MsgGUID: eWL3oNtuS0C8MCyVIQGETw== X-IPAS-Result: A0BLAgAQ5u1q/5D/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAE9HAMBAgMCJgICKyMIGYMCAYI6AzcDEbw/en8zgQGCZkMBPwJDUNhMEG+BaAELFAGBCi6FQoMgAYUDXRgBhH0nG4FJRIEVg2mBBYFcAoU8gmoEgxwSgVoejHoCgVGGeUiBAhwDWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XL1gbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ9AW4Hkj2CRUwBHx5RAStGWoEMkzeQHoIhoRGEKowklToaM4VbpRYLmH2OCpZRhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaIRhiyEtgU8BAQ IronPort-Data: A9a23:keOscaDcki1JrxVW/37iw5YqxClBgxIJ4kV8jS/XYbTApGxwgWMDz GJJUG3VafuMamakf9xyPIXno0oCuZbVzIUxOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE2Op2Kho4YbIk0clTAWBC1 8Y4Dy0zV0XW7w626OrTpuhEnM8vKozveYgYoHwllW6fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYzBPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOkFEqgOaxaoO9ltqiSPpxxUG+u n/9p0+pJzoLCv2m5he57Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTVlezf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ12FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:LRpyWqvvtQ//gLG/ESnNon0W7skDVNV00zEX/kB9WHVpm6uj5q eTdZUgpHvJYVkqNk3I9ersBEDEewK+yXcX2/h1AV7dZmjbUQKTRekIh7cKgQeQeREWndQz6U 4PScRD4aXLbWRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaDZ2JK2xCe36m+oocfng+OaYE X-Talos-CUID: 9a23:JxqhR24c4k4p3rsqjNss71EMPJsrLkLh51j0I060K1xJb6CrcArF X-Talos-MUID: 9a23:b5NiSQQURSysVbUDRXThuxU5M+F0/p/2IxAouoQ4mvCrGBBvbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386421" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 83D151800048B for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 18615CC1611; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 14/27] python3-git: fix CVE-2026-76221 Date: Fri, 6 Nov 2026 06:43:18 -0800 Message-Id: <20261106144331.3354811-15-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249672 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf [2] https://security-tracker.debian.org/tracker/CVE-2026-76221 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Expanded the embedded commit rationale to describe unsafe option-name serialization and the validator’s coverage. Added Assisted-by and Co-authored-by trailers. The source validator remains the same; the embedded diff removes an extra blank line. --- .../python/python3-git/CVE-2026-76221.patch | 59 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch new file mode 100644 index 0000000000..80198bde6c --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76221.patch @@ -0,0 +1,59 @@ +From 46f9c03ed10d25146293003791476955f8b26a73 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:57:12 +0000 +Subject: [PATCH] Reject syntax-bearing git config option names + + +GHSA-jm78-9fvv-mhgr reports that config option names containing Git +syntax can be serialized as unintended directives. A regression test showed +that set, set_value, and add_value accepted delimiter, comment, bracket, and +whitespace characters in option names. + +Restrict written option names to GitPython's established safe character set of +letters, digits, hyphens, underscores, and dots. This blocks characters that +can change config syntax while preserving option names historically supported +by the writer and SectionConstraint. + +A broader audit confirmed that every public option-creating config API and +SectionConstraint delegate reaches this validator; no separate config writer +sink was found. The behavior was checked against Git cf5497b14, and the full +config test module plus dotted-option regression pass. + +CVE: CVE-2026-76221 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf] + +Backport Changes: +- Omitted test/test_config.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit a495ccd3b547ccd60b2187215823b72a9c0188bf) +Signed-off-by: Yogita Urade +--- + git/config.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/git/config.py b/git/config.py +index cbfc7ebd..de1b9572 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -74,6 +74,8 @@ UNSAFE_CONFIG_CHARS_RE + UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]") + """Characters that cannot be safely written in config names or values.""" + ++VALID_CONFIG_OPTION_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$") ++"""Pattern for option names that can be written without changing config syntax.""" + + + class MetaParserBuilder(abc.ABCMeta): # noqa: B024 +@@ -875,6 +877,8 @@ GitConfigParser._assure_config_name_safe + def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None: + if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name): + raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label) ++ if label == "option" and isinstance(name, str) and not VALID_CONFIG_OPTION_NAME_RE.fullmatch(name): ++ raise ValueError("Git config option names may contain only letters, digits, '-', '_', or '.'") + if label == "section" and isinstance(name, str): + in_quotes = False + escaped = False diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index f0ffb70df8..42d251a2df 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -36,6 +36,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73620.patch \ file://CVE-2026-73619_p1.patch \ file://CVE-2026-73619_p2.patch \ + file://CVE-2026-76221.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103289 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=f/tf+UdJ; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4296; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=mwDFEgrJAMK0etOX4nFm87CyxenRljnOMzz7FdZMEBw=; b=f/tf+UdJDlO8EmmSXmTWaQOc0xuTKq2NE2L5C57MIjWzd5ZcckkmJNO9 pQ06ZIiwMf6KK8pecs8zREr5vVNxgj1OvIJr6MGCxeaZO7fMA7JbJJZzZ nfg9trFg320yUkogkoNyYzHFyyFTwDgYlA8NOZtpWoe1FLYWJELZ0ZvDH hkuSbFaEDqRjJYc/r62AO8re5WLAcDHBJD0vq3gz1lavcu179qXW/Bf54 BOgYPtzYDzUL4W1T+wUi83aHikqgRP8Jq3zZMIYk96oPwoGvJ6dSY/Z3m HwPRl4n3uLbb68V/S96MG7FNSY7gc9vqoKJ6V9oohyAX1k8e+zC5bkMoO w==; X-CSE-ConnectionGUID: NFN3cV9ORfOfjESb9ayiHQ== X-CSE-MsgGUID: X2cWse9TR5We+h+OzNegfQ== X-IPAS-Result: A0BJAgAN5+1q/47/Ja1aglmCV3VgQ0kDlCeCIQOeIRSBag8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvE2BeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBhH0nG4FJRIEVg2mBBYFcAoFGhmAEgxwSgVqBA4wVAoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYJFTQEeHlEBCiGBIIEMkzeSP6ERhCqMJJU6GjOqcQuYfY4KllGEaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUcYIJjICBgMDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:FhnUBKiRW0+9EWYhqdqlbbG3X161NxEKZh0ujC45NGQN5FlHY01je htvWmiAOqnfMGH1L9EkbYrgp0MOu8fQyIA1QQI4/yBgFnhjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvre8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU+1MAsCl8f0 sYWDz4PQyuJ1uunwZKCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbHuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg1/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOIozWHJUFzi50o Er2pW/GGRxLCObC9jfG8jGLlMnCki3CDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBZCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:znFvtqwEKiwpW3j+0yV7KrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:RyeVN2g/9swtQYov2JYOgZn2qTJuVFP7l3zucmiCB0FnSpCuQw6Z6aJEqp87 X-Talos-MUID: 9a23:RlD3zA3YzS+3GvP8lF61TvbvJzUj0/6lN1sAwKk85vaJdiwzHCW7gTu5e9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841888" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id CC61018000377 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 1E85CCBF201; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 15/27] python3-git: fix CVE-2026-76220 Date: Fri, 6 Nov 2026 06:43:19 -0800 Message-Id: <20261106144331.3354811-16-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249674 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541 [2] https://security-tracker.debian.org/tracker/CVE-2026-76220 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Removed the stale cherry-pick and Signed-off-by trailers and refreshed the embedded hunk context. --- .../python/python3-git/CVE-2026-76220.patch | 65 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch new file mode 100644 index 0000000000..1a42e7cf04 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch @@ -0,0 +1,65 @@ +From 8f29b889df8dff1c1227dafabac0f49306d45838 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 08:59:57 +0000 +Subject: [PATCH] Check joined short-option values before Git execution + + +GHSA-wvpp-8hx9-p66j reports that unsafe-option checks omitted the value +joined to a one-character option when split_single_char_options was false. A +regression test reproduced the mismatch: GitPython checked only -n even though +it emitted a joined -nVALUE token that Git parses as clustered short options. + +Collect the exact joined token for unsplit one-character keyword arguments so +the existing clustered-short-option validation sees every option character. +The split form and long-option behavior remain unchanged. + +A broader audit confirmed that all guarded keyword-forwarding APIs use +_option_candidates, including clone, ls-remote, fetch, pull, push, archive, +revision, diff, checkout-index, and tag paths. Git cf5497b14 confirms repeated +short-option parsing within a joined token. Focused candidate and unsafe-option +tests pass. + +CVE: CVE-2026-76220 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541] + +Backport Changes: +- Omitted test/test_git.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 96a888f4d782cb2f80452148e48e60ce4af6d541) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 2ce27290..de68fa34 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -809,13 +809,21 @@ Git._option_candidates + values = value if isinstance(value, (list, tuple)) else (value,) + if any(value is True or (value is not False and value is not None) for value in values): + key = str(key) +- options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}") +- if len(key) == 1 and split_single_char_options: ++ if len(key) != 1: ++ options.append(f"--{dashify(key)}") ++ elif split_single_char_options: ++ options.append(f"-{key}") + options.extend( + str(value) + for value in values + if value is not True and value not in (False, None) and str(value).startswith("-") + ) ++ else: ++ options.extend( ++ f"-{key}" if value is True else f"-{key}{value}" ++ for value in values ++ if value is True or (value is not False and value is not None) ++ ) + return options + + class AutoInterrupt: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 42d251a2df..4a3d516244 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -37,6 +37,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73619_p1.patch \ file://CVE-2026-73619_p2.patch \ file://CVE-2026-76221.patch \ + file://CVE-2026-76220.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103290 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7518.1793976213994639424 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=BRssb84n; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7393; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+Jr7+GuhDU2R3K5erzGKWoKvCiForUPjbG++J2PneSY=; b=BRssb84nwLuaMpN3je3/no3RrSviN05gJbhwM3EFNsDcliAsHwQYlCV6 AUt7QnGFWYCaJwD82S92GxLOPBrPJATOD72HIId9dAHyMltGzftLPB1CH nAGpRpcgaaQ83B2TzQbZ/QKKdXqCJkpIinU22336xwSvZXiarCMNrmVTL 5K34o0Fs2Eq0F4cl6MwyEh8eEJFi9lX/34/m/JhkpkoYjQtKirKd7e2iq /tCCGjo8O2d5qtszBvlfWUwmkvI4p7IaMk35s9o1eYCfHI0yBN7XfTgAF 5iVWvaWWA5HTi0oKxMx9stH2eGCWGZPUo5NtZ7mQ8ZBq/G2f+YjTGXMHr A==; X-CSE-ConnectionGUID: G6C69vwTSxOZnUSZdGsoQA== X-CSE-MsgGUID: FcG601fpQ3uaK+uJGYx6IA== X-IPAS-Result: A0BJAgAQ5u1q/5X/Ja1aglmCV3VgQ0kDlCeCIQOeIRSBag8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAhYZKyMIGYMCAYI6AzcDEbw/gXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAUSCVoFjJxuBSUSBFYNpgQWBXAKBGS0BWIYHBIMcEoFagQMJjAwCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gh8mOwsHATxRASsEgRQIgQwiLJJnkkGhEYQqjCSVOhozhASBV4s9hwWSVAuYfY4KllGEaYFoPIFZMxoIGxU7gmcJShkPjjmDa4UTUcYIJjICCQMvAQEHAgcOAwuBaJAALIFSAQE IronPort-Data: A9a23:Vkl9BKtKfgFFOuIE0QcAmOW1yOfnVAFfMUV32f8akzHdYApBsoF/q tZmKWqGbquMZzameYwibIyzpxsPv57czdQ3HVBp+H03QywXgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Us21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw1bhcXzBQ6 sAjOBc/aC24te6Z27WCY7w57igjBJGD0II3oHpsy3TdSP0hW52GGv+M7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtGYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIJoHTHJQOzxbwS mTu0W/WXElDOsSmkieM0TGxpMD+jX3acddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1dFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:vmCWxawrWjc0WTpD2aiAKrPwAL1zdoMgy1knxilNoHtuA6ilfq +V8sjzuSWYtN9VYgBCpTniAtjkfZqjz/9ICOAqVN/INjUO+lHYTr2KhrGM/9SPIUHDH5ZmtZ tIQuxZFMD6C0R8gILR5Qm1FMtl/fy8mZrY4ts3CxxWPHhXg2YK1XYeNjqm X-Talos-CUID: 9a23:SEQtwWmjMW7/N9jpnmgMbMRAKQrXOVKD5ymBPVCEMnZOeruocm2c17hjquM7zg== X-Talos-MUID: 9a23:kYyE8QwI0jJNTU9Fc4/eB8aW98maqIqlJx5VyJsegpKZPA8zJhWyvSTpY6Zyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545119398" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id C951318000276 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 2469BCBF203; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 16/27] python3-git: fix CVE-2026-76219 Date: Fri, 6 Nov 2026 06:43:20 -0800 Message-Id: <20261106144331.3354811-17-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249675 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32 [2] https://security-tracker.debian.org/tracker/CVE-2026-76219 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Removed the stale cherry-pick and Signed-off-by trailers and refreshed the embedded hunk context. --- .../python/python3-git/CVE-2026-76219.patch | 153 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 154 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch new file mode 100644 index 0000000000..719e80b4e0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch @@ -0,0 +1,153 @@ +From dbf247f0779367b555b55d54941ead00e999eee6 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sun, 2 Aug 2026 09:06:40 +0000 +Subject: [PATCH] Guard read-tree index output paths + + +GHSA-4gmw-gg2m-w46p reports that caller-controlled treeish arguments could +be parsed by git read-tree as --index-output and select an arbitrary output +path. A regression test showed that from_tree reached Git instead of raising +UnsafeOptionError; the same unchecked path was reachable through reset and +both merge_tree treeish positions. + +Add the project-standard unsafe-option guard and explicit opt-out to +from_tree, merge_tree, and reset. Check positional and keyword candidates so +abbreviations and alternate forwarding forms are covered before read-tree +runs. + +A broader audit found only two read-tree sinks in the codebase; both are now +guarded, and reset delegates to the guarded from_tree path. The only remaining +index-output use is GitPython's controlled temporary index. Git cf5497b14 +confirms read-tree parses this path-taking option before tree arguments. +Focused index tests and Ruff checks pass. + +CVE: CVE-2026-76219 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32] + +Backport Changes: +- Omitted test/test_index.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 9b5dcaf85da5946dbf69dcd53f9edba08f760b32) +Signed-off-by: Yogita Urade +--- + git/index/base.py | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +diff --git a/git/index/base.py b/git/index/base.py +index e10bfd68..fb1acb1a 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -130,6 +130,7 @@ class IndexFile: + index directly before operating on it using the git command. + """ + unsafe_git_checkout_index_options = ["--prefix"] ++ unsafe_git_read_tree_options = ["--index-output"] + + + __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path") +@@ -256,7 +257,12 @@ def merge_tree + + @post_clear_cache + @default_index +- def merge_tree(self, rhs: Treeish, base: Union[None, Treeish] = None) -> "IndexFile": ++ def merge_tree( ++ self, ++ rhs: Treeish, ++ base: Union[None, Treeish] = None, ++ allow_unsafe_options: bool = False, ++ ) -> "IndexFile": + """Merge the given `rhs` treeish into the current index, possibly taking + a common base treeish into account. + +@@ -270,6 +276,9 @@ def merge_tree + Optional treeish reference pointing to the common base of `rhs` and this + index which equals lhs. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + self (containing the merge and possibly unmerged entries in case of + conflicts) +@@ -280,6 +289,12 @@ def merge_tree + yourself, you have to commit the changed index (or make a valid tree from + it) and retry with a three-way :meth:`index.from_tree ` call. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([base, rhs]), ++ unsafe_options=self.unsafe_git_read_tree_options, ++ ) ++ + # -i : ignore working tree status + # --aggressive : handle more merge cases + # -m : do an actual merge +@@ -324,7 +339,13 @@ def from_tree + return inst + + @classmethod +- def from_tree(cls, repo: "Repo", *treeish: Treeish, **kwargs: Any) -> "IndexFile": ++ def from_tree( ++ cls, ++ repo: "Repo", ++ *treeish: Treeish, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> "IndexFile": + R"""Merge the given treeish revisions into a new index which is returned. + The original index will remain unaltered. + +@@ -348,6 +369,9 @@ def from_tree + :param kwargs: + Additional arguments passed to :manpage:`git-read-tree(1)`. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :return: + New :class:`IndexFile` instance. It will point to a temporary index location + which does not exist anymore. If you intend to write such a merged Index, +@@ -365,6 +389,12 @@ def from_tree + if len(treeish) == 0 or len(treeish) > 3: + raise ValueError("Please specify between 1 and 3 treeish, got %i" % len(treeish)) + ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates(treeish, kwargs), ++ unsafe_options=cls.unsafe_git_read_tree_options, ++ ) ++ + arg_list: List[Union[Treeish, str]] = [] + # Ignore that the working tree and index possibly are out of date. + if len(treeish) > 1: +@@ -1398,6 +1428,7 @@ def reset + working_tree: bool = False, + paths: Union[None, Iterable[PathLike]] = None, + head: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "IndexFile": + """Reset the index to reflect the tree at the given commit. This will not adjust +@@ -1429,6 +1460,9 @@ def reset + The paths need to exist at the commit, otherwise an exception will be + raised. + ++ :param allow_unsafe_options: ++ Allow options that may write to arbitrary paths. ++ + :param kwargs: + Additional keyword arguments passed to :manpage:`git-reset(1)`. + +@@ -1445,7 +1479,7 @@ def reset + """ + # What we actually want to do is to merge the tree into our existing index, + # which is what git-read-tree does. +- new_inst = type(self).from_tree(self.repo, commit) ++ new_inst = type(self).from_tree(self.repo, commit, allow_unsafe_options=allow_unsafe_options) + if not paths: + self.entries = new_inst.entries + else: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 4a3d516244..df2eea60bc 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -38,6 +38,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-73619_p2.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ + file://CVE-2026-76219.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103286 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7336.1793976213937852288 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hVLfrMx0; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5238; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=zzx8ShXTbwGH7JNImzyN0xvuAYO48Ht0jZ0Kx7GjuL4=; b=hVLfrMx0Sv3p3/bdGg0+KSH7qMNwQpYuTKQLmefPKaTdFM9IwfZ9W7XV LpbwCnhYv7Err03aEt1zhFe/mgnzMOER5vn6QbQ5Yczrn+wBNhUCVci5N usEQUvLHdVTIaAbvornNvbbCsWc6/ZbhtbR7zOl1j6BOei7ByroElih+U BpaAWKQ8JSxFEIdmsSzrtJV6g398ygxFZm3z0t6BLM2iKFW44uOSgTX/P 95Tn4yhWEAzAKOPSIHucT/VT2zSSDp7txwSiOXe1tmJ7WDkT8kofR5VZB FGWA1c9DEL6Pl3qYEHHfWzoZ5o5U0V9C200LD8aTk1mRPRpEnre9lullz A==; X-CSE-ConnectionGUID: 5bf6AD2eTkKZcK355+uAzw== X-CSE-MsgGUID: T3xsEiw0SFmwABNRz0pFAw== X-IPAS-Result: A0BJAgAQ5u1q/5X/Ja1aHgEBCxIMggULgld1YENJA5QngiEDniEUgWoPAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbw/gXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAYR9JxuBSUSBFYNpgQWBXAKBRoZgBIINgQ8SgVoejHoCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gh8mOxIBHh5RARAbgVpSJKVSoRGEKowklToaM4VbpRYLmH2OCpU1gRyEaYFoPIFEDgczGggbFYMiCUoZD445g2uFE1HGCCYyAgkDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:iA90FKCqygf9KBVW/37iw5YqxClBgxIJ4kV8jS/XYbTApGwghGdWm zdLXDyEPqmLZmbzL9p/bNuypE4D65/Tz942OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEnv9gUmgaZ4Ak+cVFCkIVq KFbNRkfcUXW7w626OrTpuhEnM8vKozveYgYoHwllGufBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY+BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOkFEqgOaxaoC9ltqieZ5FhWuZu Tr90WHmKzs8Ds7H0RSs7Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTUkOzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ22FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:cY1456uBmzP6Q7U6cEFCULu77skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:IR+fgmPjdn+exe5DBSNpqmc4QM0ZcV7vx1SLfhL7FE97V+jA X-Talos-MUID: 9a23:cJPUxAo7f47SCVr/Ag4ezw05JNxF4rv2M24IjrwsnfOWbTReEijI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386422" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id C958618000337 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 2AAC7CBF202; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 17/27] python3-git: fix CVE-2026-76218 Date: Fri, 6 Nov 2026 06:43:21 -0800 Message-Id: <20261106144331.3354811-18-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249678 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7 [2] https://security-tracker.debian.org/tracker/CVE-2026-76218 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Removed the stale cherry-pick and Signed-off-by trailers and cleaned the Backport Changes formatting. --- .../python/python3-git/CVE-2026-76218.patch | 92 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch new file mode 100644 index 0000000000..1a2bf8ca8e --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch @@ -0,0 +1,92 @@ +From e9a64de6632678594079cf3e020cbaff44b31615 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 02:48:01 +0000 +Subject: [PATCH] Guard unsafe git init options + + +GHSA-9rj7-rf2p-w77r reports that Repo.init forwarded git-init +options without applying GitPython's unsafe-option policy. A regression +showed template and abbreviated option spellings reached Git without an +UnsafeOptionError and could create the destination before validation. + +Add a git-init denylist for template installation and separate Git +directory redirection, check keyword options before any path or directory +mutation, and provide the standard explicit allow_unsafe_options escape +hatch. This preserves trusted uses while rejecting untrusted forwarding by +default. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) confirmed that init and clone are the +built-in commands that consume repository template directories. Clone, +clone_from, and submodule cloning already share the guarded clone helper; +the similarly named commit option only reads a commit-message template. + +Validated with the focused init regression, the clone/init unsafe-option +suite, 185 config/Git/index/clone tests, Ruff, and basedpyright. + +CVE: CVE-2026-76218 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7] + +Backport Changes: +- Omitted test/test_repo.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit d9ddb55bdc66ffe8c9932fe460e6b8c8211e47c7) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/git/repo/base.py b/git/repo/base.py +index 4b783586..fd6d660d 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -141,6 +141,14 @@ class Repo: + re_author_committer_start = re.compile(r"^(author|committer)") + re_tab_full_line = re.compile(r"^\t(.*)$") + ++ unsafe_git_init_options = [ ++ # Can install hooks that execute during later Git commands: ++ "--template", ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", ++ ] ++ """Options to :manpage:`git-init(1)` that permit unsafe code execution or I/O.""" ++ + unsafe_git_clone_options = [ + # Executes arbitrary commands: + "--upload-pack", +@@ -1345,6 +1353,7 @@ class Repo: + mkdir: bool = True, + odbt: Type[GitCmdObjectDB] = GitCmdObjectDB, + expand_vars: bool = True, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "Repo": + """Initialize a git repository at the given path if specified. +@@ -1369,6 +1378,10 @@ class Repo: + information disclosure, allowing attackers to access the contents of + environment variables. + ++ :param allow_unsafe_options: ++ Allow unsafe options to be used, such as ``--template`` and ++ ``--separate-git-dir``. ++ + :param kwargs: + Keyword arguments serving as additional options to the + :manpage:`git-init(1)` command. +@@ -1376,6 +1389,11 @@ class Repo: + :return: + :class:`Repo` (the newly created repo) + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=cls.unsafe_git_init_options, ++ ) + if path: + path = expand_path(path, expand_vars) + if mkdir and path and not osp.exists(path): diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index df2eea60bc..173643a49b 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -39,6 +39,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76221.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ + file://CVE-2026-76218.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103293 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7340.1793976214807337239 for ; Fri, 06 Nov 2026 06:43:34 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=gomBAxDh; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8441; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=GCZHPRgxOw8bl5g2501jEX2Z508XfoDcsblqlQ2j6OI=; b=gomBAxDhs//Lcu30WeVdsgLTptxg2HdJMw9NRC/VJbF9wSDadjEqJyqI y9VBJs7chSI82QnmbeEM2YdyKY0C6g37fDQW3PBoECdCVRP0yJvFfTc6z pSaAn9NF3oedISGzaUaEMmrdQOlv4W5yVh92WCuETYjIZwMsD77OpnZuP HH2iFXXzYmpz48px8cNcWkgIFPVxdOvS91erONe40CpLc+DfUhza8KfZB vbP1mJNzNkfssSW84p9ti+0PkrpN6nUHr+kkc9OcmROnQI21d5AhlupTp IotLtGv5jwuPrrNU4SAVmYpy+VGWO574BcqjPo1fQ9iqPOui3YnmtjT03 w==; X-CSE-ConnectionGUID: EHijw0A1Q66BSZbm4qN80Q== X-CSE-MsgGUID: cg65ra24QSe05j6KGO7Fnw== X-IPAS-Result: A0BJAgCS5u1q/4//Ja1aglmCV3VgQ0kDlCeCIQOeIRSBag8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRRrt/gXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4hUKIJF0YAYR9JxuBSUSBFYNpgQWBXAKBJx8Bhl8Egg2BDxKBWoEDgiKJcwKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CHyY7CwcBPB8fEwEQG4F4BQENIQUKAgIRkxGSQaERhCqMJJU6GjOFW6UWC5h9jgqWBE2EaYFoPIFDDwczGggbFTuCZwlKGQ9ejVuDa4UTUcYIJjICBgMDLwEBBwIHDgMLgWiQAAImB4FPAQE IronPort-Data: A9a23:UNLGPKzza9BvY4kbdPB6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkUEn 2EaDT2Da/+ONGH1ft8kaojn9htVuMCGxtBqSlZvpVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGwWPI8Hos8uOD8Q3 8cqIjVRdzbT39vjldpXSsE07igiBNPgMIVavjRryivUSK54B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOHWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeSxYIWOJ4XTLSlTtk2X+ D/c9j6lOyoXbIGdlxmq1S2CgPCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1jfDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:k1mi3a5R1i6BEdiDpwPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:9gGCaGODBhV2MO5DdQlm9lFMM5kcLCP390XaJhOhLzYxcejA X-Talos-MUID: 9a23:1BFVLw1fCixscnhmplJ/fcPRzDUj6KvwVVoEy8k/gMTcaC4uGBi60xqxXdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544873511" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:33 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id CE2E318000385 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 31A6FCBF204; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 18/27] python3-git: fix CVE-2026-76217 Date: Fri, 6 Nov 2026 06:43:22 -0800 Message-Id: <20261106144331.3354811-19-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249677 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c [2] https://security-tracker.debian.org/tracker/CVE-2026-76217 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Removed the stale cherry-pick and Signed-off-by trailers and refreshed the embedded hunk context. --- .../python/python3-git/CVE-2026-76217.patch | 179 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 180 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch new file mode 100644 index 0000000000..f369c778b0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch @@ -0,0 +1,179 @@ +From c99cba55c8ad6eff105ee61b15f7c683e7e4d878 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 03:18:54 +0000 +Subject: [PATCH] Guard pathspec file inputs in high-level commands + + +GHSA-hh9p-6wh2-4mfc reports that high-level rm and checkout wrappers +forwarded pathspec file options without GitPython's unsafe-option policy. +A regression showed that both commands surfaced multi-line pathspec data in +Git errors, while reset consumed the same caller-selected file without a +validation error. The audit also found that reset's positional commit could +carry the option before its argument separator. + +Define one shared unsafe pathspec-file option list and apply it to +IndexFile.remove, Head.checkout, and HEAD.reset before invoking Git. Check +reset's positional commit as well as keyword options, retain the standard +allow_unsafe_options escape hatch for trusted callers, and cover abbreviated +long-option spellings. + +An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a +(v2.55.0.windows.3-16-gcf5497b14c) found pathspec-file support in add, +checkout/restore, commit, reset, rm, and stash. GitPython has no arbitrary +high-level option forwarding to the other commands, and git mv does not +support this option. + +Validated with focused rejection and opt-in tests, 214 affected-module +regressions, Ruff, basedpyright, and git diff --check. + +CVE: CVE-2026-76217 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c] + +Backport Changes: +- Omitted test/test_git.py, test/test_index.py, test/test_refs.py because the + current PyPI source archive does not include the test suite and the + python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit f2550b65bf60ca087190981e2c7b6865e201f40c) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 6 ++++++ + git/index/base.py | 10 ++++++++++ + git/refs/head.py | 27 ++++++++++++++++++++++++++- + 3 files changed, 42 insertions(+), 1 deletion(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 63bbb3f7..20abd015 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -421,6 +421,12 @@ class Git(metaclass=_GitMeta): + + re_unsafe_protocol = re.compile(r"(.+)::.+") + ++ unsafe_git_pathspec_from_file_options = [ ++ # Reads pathspecs from a caller-controlled file. Some commands include an ++ # unmatched pathspec in their error output, which can disclose the file. ++ "--pathspec-from-file", ++ ] ++ + def __getstate__(self) -> Dict[str, Any]: + return slots_to_dict(self, exclude=self._excluded_) + + +diff --git a/git/index/base.py b/git/index/base.py +index fb1acb1a..f5932f2d 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -1011,6 +1011,7 @@ IndexFile.remove + self, + items: Sequence[Union[PathLike, Blob, BaseIndexEntry, "Submodule"]], + working_tree: bool = False, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> List[str]: + R"""Remove the given items from the index and optionally from the working tree +@@ -1041,6 +1042,10 @@ IndexFile.remove documentation + physically removing the respective file. This may fail if there are + uncommitted changes in it. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-rm(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to :manpage:`git-rm(1)`, such as + ``r`` to allow recursive removal. +@@ -1052,6 +1057,11 @@ IndexFile.remove unsafe-option validation + This is interesting to know in case you have provided a directory or globs. + Paths are relative to the repository. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + args = [] + if not working_tree: + args.append("--cached") + +diff --git a/git/refs/head.py b/git/refs/head.py +index 7e6fc337..1b82fbd3 100644 +--- a/git/refs/head.py ++++ b/git/refs/head.py +@@ -19,6 +19,7 @@ HEAD.reset import + + from typing import Any, Sequence, TYPE_CHECKING, Union + ++from git.cmd import Git + from git.types import Commit_ish, PathLike + + if TYPE_CHECKING: +@@ -66,6 +67,7 @@ HEAD.reset signature + index: bool = True, + working_tree: bool = False, + paths: Union[PathLike, Sequence[PathLike], None] = None, ++ allow_unsafe_options: bool = False, + **kwargs: Any, + ) -> "HEAD": + """Reset our HEAD to the given commit optionally synchronizing the index and +@@ -88,12 +90,21 @@ HEAD.reset option validation and documentation + Single path or list of paths relative to the git root directory + that are to be reset. This allows to partially reset individual files. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-reset(1)`. ++ + :param kwargs: + Additional arguments passed to :manpage:`git-reset(1)`. + + :return: + self + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([commit], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + mode: Union[str, None] + mode = "--soft" + if index: +@@ -238,7 +249,12 @@ Head.checkout signature + self.path = "%s/%s" % (self._common_path_default, new_path) + return self + +- def checkout(self, force: bool = False, **kwargs: Any) -> Union["HEAD", "Head"]: ++ def checkout( ++ self, ++ force: bool = False, ++ allow_unsafe_options: bool = False, ++ **kwargs: Any, ++ ) -> Union["HEAD", "Head"]: + """Check out this head by setting the HEAD to this reference, by updating the + index to reflect the tree we point to and by updating the working tree to + reflect the latest index. +@@ -250,6 +266,10 @@ Head.checkout documentation + If ``False``, :exc:`~git.exc.GitCommandError` will be raised in that + situation. + ++ :param allow_unsafe_options: ++ Allow unsafe options such as ``--pathspec-from-file`` to be passed to ++ :manpage:`git-checkout(1)`. ++ + :param kwargs: + Additional keyword arguments to be passed to git checkout, e.g. + ``b="new_branch"`` to create a new branch at the given spot. +@@ -265,6 +285,11 @@ Head.checkout unsafe-option validation + the HEAD detached which is allowed and possible, but remains a special state + that some tools might not be able to handle. + """ ++ if not allow_unsafe_options: ++ Git.check_unsafe_options( ++ options=Git._option_candidates([], kwargs), ++ unsafe_options=Git.unsafe_git_pathspec_from_file_options, ++ ) + kwargs["f"] = force + if kwargs["f"] is False: + kwargs.pop("f") diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 173643a49b..4e5eec73f1 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -40,6 +40,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76220.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ + file://CVE-2026-76217.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103297 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7342.1793976215095842948 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Actr8wPE; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11195; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=xquEIogVOmpitSVMw61cq17I3vGK7K6Triis/UnlKVo=; b=Actr8wPE5ebC6SwqS0+Bz3utd0xjybSCft0zqLd+PrjRI5aI6XLq7Dji bC387JrXSVTfKpb3YzujSRTOf0L5XUdZGj1zdZMGXW4UoLFNAod4mYX6/ HLBX0ucm4Lo1Jw0IhnrpTsyA0JzxqVwIDPS+RF3/8rbI18KbwFAJ1NtRd kPrfM6UPOhRQxdFwPQ7drwEm43lWwjNVrTVIVNL/fVte4HhJrkvWcvnGJ BIi3BvbqLtewjMcOeVHk0WsS+uVKju8zP7SSDR9a6XaByuq53dKV64MOE vsexUQXNG2Fu+/9AGgk49W56UNcbR8NfCV3/Gc69FTprGyT0VSmWJg0v3 w==; X-CSE-ConnectionGUID: 76UDMZvaS4mUd98msl5ejQ== X-CSE-MsgGUID: P3JQkNFeRday6dP+NRu+KQ== X-IPAS-Result: A0AaAACS5u1q/4//Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJA4xvhziCIQOaHIQFFIFqDwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8RYF5M4EBgykBPwJDUNhMEG+BaAELFAGBOAGFQYgkXRgBRIJWgWMnG4FJRIEVg2mBBYFcAoEnH4ZgBIMcEoFafoVChlgCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gkVNPRscBxMBByQXP4EnLyQWFJALglwBApAdgiGhEYQqjCSVOhozhASBV5JCklQLmH2KNINWlTU0GFCEaYFoPIFZMxoIGxWDIglKGQ+OOYNrhFBDUcYIJjICCQMvAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:6rTxHqsVMiQ7F3uQTAoZvhfZVufnVAFfMUV32f8akzHdYApBsoF/q tZmKWnUM6zeMDCmLYt0O9njoB4Hu8DSz9FiTlFv+XxmRSxBgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Us21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIwpbhKLUR86 /UjdDUwYkHTgvmynb+5c7w57igjBJGD0II3oHpsy3TdSP0hW52GG/uM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtMYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIIYLbHJ0IxRjwS mTuxz/bOxI8GtGlxTOUrH6Uxcn1gGDYYddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:hv0ve6CVwFLBgS3lHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:CDeq6GGy16eWoZC9qmI4qnM4P/I7e0aByUrcch+9EmI0Rb+sHAo= X-Talos-MUID: 9a23:YwqxhQkomHmbjOJF85gOdnpab+VR4IKABXoBmIRYt/HHExZteBSk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="536910536" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id CED85180004B8 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 38595CBEF6F; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 19/27] python3-git: fix CVE-2026-76222 Date: Fri, 6 Nov 2026 06:43:23 -0800 Message-Id: <20261106144331.3354811-20-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249683 This patch applies the upstream fix as referenced in [4], [5] and [6] using the commit shown in [1], regression fix in [2] and follow-up fix in [3]. [1] https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06 [2] https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd [3] https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c [4] https://security-tracker.debian.org/tracker/CVE-2026-76222 [5] https://github.com/gitpython-developers/GitPython/pull/2202 [6] https://github.com/gitpython-developers/GitPython/pull/2205 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Added upstream pull-request references. Removed stale cherry-pick/sign-off trailers from the embedded p1 and p2 patches and cleaned patch formatting. --- .../CVE-2026-76222-regression.patch | 39 ++++++ .../python3-git/CVE-2026-76222_p1.patch | 118 ++++++++++++++++++ .../python3-git/CVE-2026-76222_p2.patch | 45 +++++++ .../python/python3-git_3.1.43.bb | 3 + 4 files changed, 205 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch new file mode 100644 index 0000000000..5d416c03a8 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222-regression.patch @@ -0,0 +1,39 @@ +From b324c831cbc02c82b99c18113b622d03539d23cd Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 11:07:02 +0200 +Subject: [PATCH] Initialize submodule repository before handled failures + + +Direct recursive updates with keep_going could swallow an invalid-name +validation error and then access mrepo before assignment. Reproduce that +path and initialize mrepo before validation so recursion is safely skipped. + +Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a +validates submodule paths before operating on them. + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b324c831cbc02c82b99c18113b622d03539d23cd] + +Backport Changes: +- Omitted .basedpyright/baseline.json and test/test_submodule.py because the + current PyPI source archive does not include these development files, and the + python3-git recipe does not run the test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b324c831cbc02c82b99c18113b622d03539d23cd) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 658259cd..9b1eb0e0 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -743,4 +743,2 @@ +- # To keep things plausible in dry-run mode. +- if dry_run: +- mrepo = None ++ mrepo = None + # END init mrepo diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch new file mode 100644 index 0000000000..6c75489610 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch @@ -0,0 +1,118 @@ +From 3f48614f5b02f67daf311a6681e6e5090a7f7dc3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Sat, 1 Aug 2026 04:47:40 +0200 +Subject: [PATCH] Validate submodule names before filesystem operations + + +Submodule names read from .gitmodules can influence the separate Git directory +path. Reject empty names, absolute or drive-qualified names, and parent +components with either path separator. + +Validate before constructing module paths and before opening or mutating +existing checkouts, so a repository initialized by an older vulnerable version +cannot bypass the guard. Validate programmatic add and rename inputs before +making changes as well. + +Advisory: GHSA-hmq2-w58f-27jc + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source archive + does not include the test suite, and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit e4b8e7d026ca6abb4cf604f8e77093432ce23c06) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 43e0ec9a..a4e0077c 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -6,6 +6,7 @@ __all__ = ["Submodule", "UpdateProgress"] + import gc + from io import BytesIO + import logging ++import ntpath + import os + import os.path as osp + import stat +@@ -300,10 +301,21 @@ class Submodule(IndexObject, TraversableIterableObj): + parser.set_submodule(self) + return SectionConstraint(parser, sm_section(self.name)) + ++ @classmethod ++ def _validated_name(cls, name: str) -> str: ++ if ( ++ not name ++ or name.startswith(("/", "\\")) ++ or ntpath.splitdrive(name)[0] ++ or ".." in name.replace("\\", "/").split("/") ++ ): ++ raise ValueError("Invalid submodule name %r" % name) ++ return name ++ + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", name) ++ return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() +@@ -516,6 +528,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise InvalidGitRepositoryError("Cannot add submodules to bare repositories") + # END handle bare repos + ++ cls._validated_name(name) + path = cls._to_relative_path(repo, path) + + # Ensure we never put backslashes into the URL, as might happen on Windows. +@@ -733,6 +746,8 @@ class Submodule(IndexObject, TraversableIterableObj): + # END init mrepo + + try: ++ self._validated_name(self.name) ++ + # ENSURE REPO IS PRESENT AND UP-TO-DATE + ####################################### + try: +@@ -999,6 +1014,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("You must specify to move at least the module or the configuration of the submodule") + # END handle input + ++ self._validated_name(self.name) + module_checkout_path = self._to_relative_path(self.repo, module_path) + + # VERIFY DESTINATION +@@ -1139,6 +1155,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Need to specify to delete at least the module, or the configuration") + # END handle parameters + ++ self._validated_name(self.name) + # Recursively remove children of this submodule. + nc = 0 + for csm in self.children(): +@@ -1365,6 +1382,9 @@ class Submodule(IndexObject, TraversableIterableObj): + if self.name == new_name: + return self + ++ self._validated_name(self.name) ++ self._validated_name(new_name) ++ + # .git/config + with self.repo.config_writer() as pw: + # As we ourselves didn't write anything about submodules into the parent +@@ -1412,6 +1432,7 @@ class Submodule(IndexObject, TraversableIterableObj): + If a repository was not available. + This could also mean that it was not yet initialized. + """ ++ self._validated_name(self.name) + module_checkout_abspath = self.abspath + try: + repo = git.Repo(module_checkout_abspath) diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch new file mode 100644 index 0000000000..1f21369acd --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch @@ -0,0 +1,45 @@ +From 4a0dfd9b336dd9332b347c3af8e8ec536017d863 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 4 Aug 2026 10:08:41 +0200 +Subject: [PATCH] Validate submodule names on every module path branch + + +_module_abspath only validated names when Git used separate gitfile +submodule directories, so legacy Git behavior could accept the same invalid +name. Validate before selecting the Git-version-dependent path branch and +cover the legacy branch explicitly. + +Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a +validates submodule paths before filesystem operations. + +CVE: CVE-2026-76222 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4299c990e1ca21896f9485277caf7bb0ae5b404c) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index a4e0077c..d25df367 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -314,8 +314,9 @@ class Submodule(IndexObject, TraversableIterableObj): + + @classmethod + def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike: ++ name = cls._validated_name(name) + if cls._need_gitfile_submodules(parent_repo.git): +- return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name)) ++ return osp.join(parent_repo.git_dir, "modules", name) + if parent_repo.working_tree_dir: + return osp.join(parent_repo.working_tree_dir, path) + raise NotADirectoryError() diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 4e5eec73f1..ef1c687c02 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -41,6 +41,9 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76219.patch \ file://CVE-2026-76218.patch \ file://CVE-2026-76217.patch \ + file://CVE-2026-76222_p1.patch \ + file://CVE-2026-76222-regression.patch \ + file://CVE-2026-76222_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103299 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=gqLs1ZPe; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10646; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=bLR8C6l6fNGqDBPrw7wW0BX1zhBoI8M+U275u3SSFmU=; b=gqLs1ZPeZSun8WonfOQ186x36TcyMCrWHK1t1w4azACkfO2C70c4ayeS yXeUKQ3dxwvPdiSnjug9lqpd73NUl0wuwejHpux+c//h97DtNAikKRX1o +qZrGBNtUImr8/uaiXJV+ZWkFRFH7UsM9U5PmcL0Lj9CMLAjLjT4mXvDV 6nkjzBJLf7uOmeRTPmfYdbDU1CtSbGqE3ya0rxVVhOeuUm6pUyJtF/Yvz ZMlZgA3ZMfH0Z7nS3T4T5eSZnLg0e7mxNd+5+GPZEEAG3b1xJAQFx0PxX idnx5lF2woVk0/iIEKtZqUC4bDriA2vOvWPsfG50wrHS1kHOwLcnxD9RS g==; X-CSE-ConnectionGUID: ZSbaOiFsTxqgsQnTWWstbg== X-CSE-MsgGUID: OOC55It9RSGQKp/sJcVJQA== X-IPAS-Result: A0BJAgAN5+1q/5T/Ja1aH4I6gld1YENJA5QngiEDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgjoDNwMRvE2BeTOBAYMpAT8CQ1DYTBBvgWgBCxQBgTiFQogkXRgBRIJWgWMnG4FJRIEVg2mBBYFcAogmBIINgQ8SgVqBA4wVAoFRW4YeSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CHyYIJQ4SLTYrASsEgigcBiylKJ9TgT6EKowklToaM4QEgVeSQpJUC5h9jgqVPEhNhGmBaDyBWTMaCBsVO4JnCUoZD44rDgscg0SFE1HGCCYyAgYDAy8BAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:kySK96AF7R+SHBVW/37iw5YqxClBgxIJ4kV8jS/XYbTApDkggjZSn WBKWmuAM/bYamD2KNpwa42y/R4CsMDdnN9kOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE8c5kBWY3E5Yk6v94GlhIy cMnMywHYUXW7w626OrTpuhEnM8vKozveYgYoHwllGifBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY/BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOl1QhjOG9YIu9ltqiYuJ+wxu5u jP8xEvAIQldL/6U9xi82yf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTUk+zf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQz2FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:lPk0P6PD1fDYdMBcTu2jsMiBIKoaSvp037BN7TEUdfU7SKKlfq yV8cjzkCWE6wr5O0tQ/OxoRpPgfZq0z/cciuMs1PWZLWvbUQCTQ72Kg7GP/9SZIU3D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:vb/bKWpp/oLSmMQvZlWa/rfmUfIeeHT6zVnLH1+hBn1QToGqdkSM8qwxxg== X-Talos-MUID: 9a23:RpLqyw8R/2Z06AqUcj+3kDKQf+BPyPnzKVxcq64pguqccjdSMAm/tR3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841889" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id D358E180002C7 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 3F3ECCBEF71; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679 Date: Fri, 6 Nov 2026 06:43:24 -0800 Message-Id: <20261106144331.3354811-21-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249685 This patch applies the upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6 [2] https://security-tracker.debian.org/tracker/CVE-2026-78678 [3] https://security-tracker.debian.org/tracker/CVE-2026-78679 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Added --exec to the ls_remote unsafe-option list. Converted the configurable clusterable-short-option string to a frozenset before membership checks, and updated the ls_remote documentation. --- .../CVE-2026-78678_CVE-2026-78679.patch | 220 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 221 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch new file mode 100644 index 0000000000..337efbe22f --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch @@ -0,0 +1,220 @@ +From 51216053bd6885b546be8e9ed2e8e1000e7ee5a3 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Wed, 5 Aug 2026 04:48:36 +0200 +Subject: [PATCH] Block file-reading Git options + + +Reject file-reading options passed to blame, diff, and tag APIs. Inspect +positional values after resolving aliases, recognize unsafe options +behind command-specific short-flag clusters, and retain the explicit +allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and +GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink. + +Regression tests cover long, short, and clustered options, incremental blame, +tag path/reference positionals, the ref keyword alias, both diff entry points, +and preservation of diff pickaxe behavior. + +Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options. + +CVE: CVE-2026-78678 CVE-2026-78679 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6] + +Backport Changes: +- Omitted test/test_diff.py, test/test_refs.py, test/test_remote.py, + test/test_repo.py because the Wrynose PyPI source archive does not include + the test suite and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6) +Signed-off-by: Yogita Urade +--- + git/cmd.py | 11 +++++++---- + git/diff.py | 7 ++++--- + git/index/base.py | 3 ++- + git/refs/tag.py | 10 ++++++---- + git/repo/base.py | 24 ++++++++++++++++++++---- + 5 files changed, 39 insertions(+), 16 deletions(-) + +diff --git a/git/cmd.py b/git/cmd.py +index 20abd015..b8ad449f 100644 +--- a/git/cmd.py ++++ b/git/cmd.py +@@ -417,6 +417,7 @@ Git.unsafe_git_ls_remote_options + unsafe_git_ls_remote_options = [ + # This option allows arbitrary command execution in git-ls-remote. + "--upload-pack", ++ "--exec", + ] + + re_unsafe_protocol = re.compile(r"(.+)::.+") +@@ -743,7 +744,9 @@ Git.check_unsafe_options signature + return dashify(option_tokens[0]) + + @classmethod +- def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None: ++ def check_unsafe_options( ++ cls, options: List[str], unsafe_options: List[str], clusterable_short_options: str = "46flnqsv" ++ ) -> None: + """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings. + + In addition to exact matches, this rejects abbreviated long options accepted +@@ -778,7 +781,7 @@ Git.check_unsafe_options clusterable short flags + # These value-less Git flags can be clustered before another short option + # (for example, ``-fuVALUE``). Stop at any other character because it may + # begin an attached value, as ``o`` does in the safe option ``-oupstream``. +- clusterable_short_options = frozenset("46flnqsv") ++ clusterable_short_options_set = frozenset(clusterable_short_options) + options_are_kwargs = all(not option.startswith("-") for option in options) + for option in options: + candidate = cls._canonicalize_option_name(option) +@@ -795,7 +798,7 @@ Git.check_unsafe_options short-option parsing + raise UnsafeOptionError( + f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it." + ) +- if option_char not in clusterable_short_options: ++ if option_char not in clusterable_short_options_set: + break + if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)): + continue +@@ -1101,7 +1104,7 @@ Git.ls_remote documentation + """List references in a remote repository. + + :param allow_unsafe_options: +- Allow unsafe options, like ``--upload-pack``. ++ Allow unsafe options, like ``--upload-pack`` or ``--exec``. + """ + if not allow_unsafe_options: + candidate_options = self._option_candidates(args, kwargs) + +diff --git a/git/diff.py b/git/diff.py +index 9a1f107b..032dfb25 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -216,8 +216,8 @@ Diffable.diff documentation + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` that can write to arbitrary +- filesystem paths. ++ If ``True``, allow options such as ``--output`` and ``-O`` that can write to ++ or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to +@@ -234,7 +234,8 @@ Diffable.diff unsafe-option validation + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + args: List[Union[PathLike, Diffable]] = [] + +diff --git a/git/index/base.py b/git/index/base.py +index f5932f2d..0ff15794 100644 +--- a/git/index/base.py ++++ b/git/index/base.py +@@ -1550,7 +1550,8 @@ IndexFile.diff unsafe-option validation + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([other], kwargs), +- unsafe_options=self.repo.unsafe_git_revision_options, ++ unsafe_options=self.repo.unsafe_git_diff_options, ++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW", + ) + + # Only run if we are the default repository index. + +diff --git a/git/repo/base.py b/git/repo/base.py +index b6fd7620..c91dd1f2 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -198,6 +198,19 @@ Repo unsafe-option lists + ] + + ++ unsafe_git_blame_options = unsafe_git_revision_options + [ ++ # These options read from arbitrary files and expose their contents through blame output. ++ "--contents", ++ "-S", ++ "--ignore-revs-file", ++ ] ++ ++ unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Reads caller-controlled order patterns from an arbitrary file. ++ "-O", ++ "--orderfile", ++ ] ++ + # Invariants + config_level: ConfigLevels_Tup = ("system", "user", "global", "repository") + """Represents the configuration level of a configuration file.""" +@@ -1102,7 +1115,7 @@ Repo.blame_incremental documentation and validation + :manpage:`git-rev-parse(1)` is a valid option. + + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + :return: + Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the +@@ -1115,7 +1128,9 @@ Repo.blame_incremental unsafe-option validation + + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options ++ options=Git._option_candidates([rev], kwargs), ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs) + commits: Dict[bytes, Commit] = {} +@@ -1205,7 +1220,7 @@ Repo.blame documentation + uncommitted changes. Otherwise, anything successfully parsed by + :manpage:`git-rev-parse(1)` is a valid option. + :param allow_unsafe_options: +- Allow unsafe options in revision argument, like ``--output``. ++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``. + + + :return: +@@ -1222,7 +1237,8 @@ Repo.blame unsafe-option validation + if not allow_unsafe_options: + Git.check_unsafe_options( + options=Git._option_candidates([rev, rev_opts_list], kwargs), +- unsafe_options=self.unsafe_git_revision_options, ++ unsafe_options=self.unsafe_git_blame_options, ++ clusterable_short_options="46bceflnpqstvw", + ) + data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs) + commits: Dict[str, Commit] = {} + +diff --git a/git/refs/tag.py b/git/refs/tag.py +index 07efa62f..d45fb7eb 100644 +--- a/git/refs/tag.py ++++ b/git/refs/tag.py +@@ -134,15 +134,17 @@ TagReference.create unsafe-option validation + :return: + A new :class:`TagReference`. + """ ++ legacy_ref = kwargs.pop("ref", None) ++ if legacy_ref: ++ reference = legacy_ref ++ + if not allow_unsafe_options: + Git.check_unsafe_options( +- options=Git._option_candidates([], kwargs), ++ options=Git._option_candidates([path, reference], kwargs), + unsafe_options=cls.unsafe_git_tag_options, ++ clusterable_short_options="46adefilnqsv", + ) + +- if "ref" in kwargs and kwargs["ref"]: +- reference = kwargs["ref"] +- + if "message" in kwargs and kwargs["message"]: + kwargs["m"] = kwargs["message"] + del kwargs["message"] diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index ef1c687c02..dc7694f593 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -44,6 +44,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222_p1.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ + file://CVE-2026-78678_CVE-2026-78679.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103295 Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7337.1793976214149599703 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=REq5hy//; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5371; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=Z4S+0jUd5yYgp6hP/gWALaBiUzhtCWD6q58KWDeoSB8=; b=REq5hy//HaLvnhSZ+c0YD0kcxCBi3gOANuO1G3oEeJ+YC+QNEIlX+qY1 edlvGkBzL9fBZf0UZzmfItOtV5WnoSdLuqeb0aEtZyKgldL6ykA/0XWfM hDeWgNrAw/GsIlWp62D9y5uDKcstEnxxr8P4A5KF0fqDjljmzL30fvhwv zE93lvHoSo2rMlkpBlLCw/J4e0KTj+kGc7pch24SFyj4GZJkKeVf4M4yF SX7CzLGszl1h4ToAUObBeWVfwB+7AgfYa+0CQNjv45Da3IoDqpxir3sDb nNKwa8xlhbgeFtTzYi1ku3YNLnpcx6yaGJtYxcfylv43xRYmMotfbTSdb Q==; X-CSE-ConnectionGUID: lA80B5+fQf+X7ABflnoxYA== X-CSE-MsgGUID: hpHaWWGtS0Kg0USwWb0kmg== X-IPAS-Result: A0AaAACS5u1q/4//Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJA4xvhziCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8RYF5M4EBgykBPwJDUNhMEG+BaAELFAGBOAGFQYgkXRgBhH0nG4FJRIEVg2mBBYFcAogmBIMcEoFajRgCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF4hgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gh8mLQ4SLw5RAStWRYERky5Dj2SCIYE1n1yEKowklToaM4QEgVelFguYfYJZizGWUYRpgWg8gVkzGggbFYMiCUoZD44uCwuDYIUTUcYIJjICCQMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:dRKaFaD3adqAARVW/37iw5YqxClBgxIJ4kV8jS/XYbTApG4qhTQPy WMWDGuDaf3eMWfxKN13OY7jp00C7Z7WyNc1OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEx9w+VGtrfoMh9KVHXkhk+ /geLyA8R0XW7w626OrTpuhEnM8vKozveYgYoHwllW+fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY0BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOl1IgieCwa4W9ltqiRd11l3mni X79p0f2WiwhK+OVkTmA/Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTXlyhrNG9i1WiQJRYM 0ES9y8koKQ++UDtScPyNyBUu1aetRIaHt4VGOog5UTVlOzf4h2SAS4PSTsphMEaifLajAcCj jeh9+4FzxQ12FFJYRpxLoupkA4= IronPort-HdrOrdr: A9a23:MKfYbqDqYVzrdM3lHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:s/P+XWAHZg/Opt76Ey1OpBY+R4MrS3Oe/Cj5CUG8D2F5eZTAHA== X-Talos-MUID: 9a23:wXArHgsqgx7YSsPPLc2nhClCPfhXzLiVUGMCyag9pPaObS91NGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="536910537" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id D3D38180004BA for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 461F9CBEF72; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 21/27] python3-git: fix CVE-2026-78677 Date: Fri, 6 Nov 2026 06:43:25 -0800 Message-Id: <20261106144331.3354811-22-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249680 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d [2] https://security-tracker.debian.org/tracker/CVE-2026-78677 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Clarified the --bundle-uri comment and changed the unsafe-clone-options docstring to cover unsafe command execution or I/O. The --separate-git-dir guard is unchanged. --- .../python/python3-git/CVE-2026-78677.patch | 87 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 88 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch new file mode 100644 index 0000000000..2f7714e6cc --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78677.patch @@ -0,0 +1,87 @@ +From 03baa6374b8769a9544292d84040b323c5f1437a Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 11:20:03 +0200 +Subject: [PATCH] Block separate git directories during clone + + +Repo.clone() and Repo.clone_from() did not reject the clone option that +redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc). +Regression coverage exercises both keyword and multi-option input through both +public clone APIs. + +Add the option to the existing clone denylist, matching Repo.init() +and the documented allow_unsafe_options contract. Git itself registers + +The Python package and Alpine test workflows failed across the submodule suite +because GitPython internally supplies --separate-git-dir when creating modern +submodule layouts. The new public clone guard correctly rejected that option, +but could not distinguish the library-generated path from caller input. + +Validate caller-provided keyword and multi-options before adding the +library-controlled metadata path, then explicitly allow the resulting trusted +clone invocation. This preserves rejection of unsafe clone_multi_options while +restoring normal submodule creation. Update the one test that intentionally +invokes Repo.clone_from() with its own separate git directory to opt in +explicitly. + +CVE: CVE-2026-78677 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d] + +Backport Changes: +- Omitted test/test_clone.py, test/test_submodule.py because the current PyPI + source archive does not include the test suite and the python3-git recipe + does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit b68afff45af0f49e79a3e2d2162018986b37ad5d) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 10 ++++++++++ + git/repo/base.py | 2 ++ + 2 files changed, 12 insertions(+) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index d25df367..410f41e2 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -9,6 +9,7 @@ import logging + import ntpath + import os + import os.path as osp ++import shlex + import stat + import sys + import uuid +@@ -360,6 +361,15 @@ class Submodule(IndexObject, TraversableIterableObj): + module_abspath = cls._module_abspath(repo, path, name) + module_checkout_path = module_abspath + if cls._need_gitfile_submodules(repo.git): ++ if not allow_unsafe_options: ++ Git.check_unsafe_options(Git._option_candidates([], kwargs), repo.unsafe_git_clone_options) ++ multi_options = kwargs.get("multi_options") ++ if multi_options: ++ Git.check_unsafe_options( ++ shlex.split(" ".join(cast("Sequence[str]", multi_options))), ++ repo.unsafe_git_clone_options, ++ ) ++ allow_unsafe_options = True + kwargs["separate_git_dir"] = module_abspath + module_abspath_dir = osp.dirname(module_abspath) + if not osp.isdir(module_abspath_dir): +diff --git a/git/repo/base.py b/git/repo/base.py +index fd6d660d..56a19dc5 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -158,7 +158,9 @@ class Repo: + "-c", + # Can install hooks that execute during clone: + "--template", ++ # Redirects the repository metadata to a caller-controlled path: ++ "--separate-git-dir", + # Fetches from an additional caller-controlled URI: + "--bundle-uri", + ] + """Options to :manpage:`git-clone(1)` that permit unsafe command execution or I/O. diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index dc7694f593..fbb1553778 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -45,6 +45,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222-regression.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ + file://CVE-2026-78677.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103294 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7520.1793976214416324349 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=UZ1rcx4g; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4543; q=dns/txt; s=iport01; t=1793976214; x=1795185814; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=leDOWQA5bwvtWi+XuZldfU1GSRXO20fRIeV80Mz2ugY=; b=UZ1rcx4gpjxO4yydlO9vkd9G32W8e68x9R8C/4Dndt0gwppd4PbGJHeJ lhtWWf1JaeNIdzuB5lvKb8aVds70UXyvAD1qqGcBTWcRzYHEy6nojdGKd OEWmnBTdTH8JHaAYZtt0I/IRkqUcFEwtry41onKjt4mHRAC9A0r0f6Ekm CvLoMSPDSkqVYKrjFBvJlLq4q1JWgHMVVgSs7IhqnMC4bZak/Rj5JSYfz IFrqtaJui9zLnnOCNyG344/dOubK3m0pNug/7sRHN/RJmh7beedju0ANf bHLtsZotOTmmpf5hvcXc2MV6ksJXCNppHVk40+Rgh4DlsDzONMb5BdREL g==; X-CSE-ConnectionGUID: K4QZqbhyRCej8mB79Ylm4Q== X-CSE-MsgGUID: qsKaWEE5Q++c74sButCoDA== X-IPAS-Result: A0BJAgAN5+1q/43/Ja1aglmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8TYF5M4EBgykBPwJDUNhMEG+BaAELFAGBOIVCiCRdGAGEfScbgUlEgRWDaYEFgVwCiCYEgxwSgVqNGAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CRUwBLU4TASuBQ2kiLKUooRGEKowklToaM4QEgVeSQpJUC5h9jgqWUYRpgWg8gVkzGggbFYMiCUoZD445g2uFE1HGCCYyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:WQ4s1qjsOIrkZvpcsW8hQO9WX161NxEKZh0ujC45NGQN5FlHY01je htvWzuOO/bYYTahKt12OYWy9kgPuZTVyNY1Glc/qHxhEihjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvre8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU7pt9FGGtO5 MYzJTJdazrc1tOyxe6CH7wEasQLdKEHPasFsX1miDWcBvE8TNWbH+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg5/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeOIozWHJUExi50o Erf5EfwPTw3aeXcijHarmmGm/Pkmg/SDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBYCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3ur8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:6XFmFa5j8hIbVDGq3wPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:PA7Kcm2mITIUJR9JQ21vc7xfOZwcQGTXzGbqCEK6WWNDF+ykTVrMwfYx X-Talos-MUID: 9a23:IjSRlgU+Rf+1+Pzq/Cb3pzhdGeo12uftAx9Rir8bp+KDGQUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="530841890" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id D7EAA180004AF for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 4CEAECBEF7A; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 22/27] python3-git: fix CVE-2026-78676 Date: Fri, 6 Nov 2026 06:43:26 -0800 Message-Id: <20261106144331.3354811-23-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249679 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb [2] https://security-tracker.debian.org/tracker/CVE-2026-78676 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. - Included the reader-side prerequisite from 47e5738074e7, which prevents IndexError when reading serialized config values. --- .../python/python3-git/CVE-2026-78676.patch | 67 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch new file mode 100644 index 0000000000..8adee8140f --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch @@ -0,0 +1,67 @@ +From 5095b034dc451f3ec0c4c77c69403c8fce7eb6d7 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:22:31 +0200 +Subject: [PATCH] fix: preserve multiline config values when writing + + +GitConfigParser decoded valid multiline values into embedded newlines, but +_write() serialized those newlines as indented physical lines. Rewriting an +otherwise unchanged config could therefore change its meaning to Git. + +Serialize resident multiline values with Git-compatible escapes inside a +quoted continuation, preserving GitPython read compatibility while keeping +each option structurally intact. This addresses GHSA-284h-m62q-gf8w. + +The regression starts with an inert multiline value, performs an unrelated +write, and verifies with both GitPython and git config that it remains one +value and does not create another option. + +Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape +embedded LF as \\n rather than emitting it as a physical config line. + +CVE: CVE-2026-78676 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb] + +Backport Changes: +- Commit 47e5738074e7 is an earlier prerequisite for this serialization + change. Its reader-side empty-string guard prevents IndexError when + reading serialized config values. +- Omitted test/test_config.py changes from both upstream commits; + the recipe source archive excludes the test suite and the recipe + does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 4b4e47fc1224e23b0c8ee7220a7192818f2e4abb) +Signed-off-by: Yogita Urade +--- + git/config.py | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/git/config.py b/git/config.py +index 30218dba..e8482a08 100644 +--- a/git/config.py ++++ b/git/config.py +@@ -454,8 +454,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + def string_decode(v: str) -> str: +- if v[-1] == "\\": ++ if v and v[-1] == "\\": + v = v[:-1] + # END cut trailing escapes to prevent decode error + + return v.encode(defenc).decode("unicode_escape") + + # END string_decode +@@ -681,7 +681,11 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder): + continue + + for v in values: +- fp.write(("\t%s = %s\n" % (key, self._value_to_string(v).replace("\n", "\n\t"))).encode(defenc)) ++ value = self._value_to_string(v) ++ if any(char in value for char in '\n\t\b\\"'): ++ value = value.replace("\\", "\\\\").replace('"', '\\"') ++ value = '"%s\\\n"' % value.replace("\n", "\\n").replace("\t", "\\t").replace("\b", "\\b") ++ fp.write(("\t%s = %s\n" % (key, value)).encode(defenc)) + # END if key is not __name__ + + # END section writing diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index fbb1553778..badbf04415 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -46,6 +46,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-76222_p2.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ + file://CVE-2026-78676.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103296 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7341.1793976215074198551 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=P+A+mWVb; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3646; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=wc+aJacDn7v/d6g/byeP3tis0hlb93WuDK5BApsqmM8=; b=P+A+mWVbWzLiRKXJIAAsXFkZASEOdwYP+fotULwQw8AzJ4NZYXIYkJ3+ qOcUZ0guKr0smeLPdA0syJWtxWyUw4BnJ31w+39ic6jPQDaKUrUKEib9i 3fFwDnFJbVi+v6MWt4tbgYPTLtKzVMuxeMK9xOsz7vdpGrsgp3SEeU3ws eilZ/GA51kHQHPdnOA+6E6lHYecQPCq3JDCu1dzNNfYVKxbKv6SmklEeS a9e9shrzZhLX5dAFEzBsQIYWie5+UZ9sAQotwo/B4EAgUvQQvAjA5S7b0 kfLT6Ph5rgmlRS+2RnUZoEKS6Ifz3J2MtcoyDzdeEy0WweDAmpsR9oDfv A==; X-CSE-ConnectionGUID: +/KarDdzSjWQSbPSwcyuSg== X-CSE-MsgGUID: ImTJRSaHSZqViKv4efULdA== X-IPAS-Result: A0BJAgAQ5u1q/4z/Ja1aglmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8P4F5M4EBgykBPwJDUNhMEG+BaAELFAGBOIVCiCRdGAGEfScbgUlEgRWDaYEFgVwCgSeGfwSDHBKBWo0YAoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyheIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYJFTT0cNQErBIENgRtOkmeSQaERhCqMJJU6GjOEBIFXkkKSVAuYfY4KllGEaYFoPIFZMxoIGxWDIglKGQ+OOYNrhRNRxggmMgIJAy8BAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:IbRS9qgSJNXRictiRqj8uKOoX161NxEKZh0ujC45NGQN5FlHY01je htvUTiBbvyNZDCgf98jPYji/U1U68PVmtBjGQJk/3gyEChjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvre8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqVbvcV+G01C5 8caFwk2ZCi4mOmn3Ym0H7wEasQLdKEHPasFsX1miDWcBvE8TNWbGOPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg9/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeJJ4faG5kPxS50o Ern+ljbOCoTFOet0ASE0Wzwi+HyuS/SDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBfCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u38Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:oRaqS6ujRto9G4yv6ThWwJS+7skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:fc0C9G2WvYhDOeugTiGXnLxfWYcGe2fxwGXrIXCBMmxRc6KeWEKr9/Yx X-Talos-MUID: 9a23:PRkDYQ1AYg1Zfy5MSpUnywG6DDUjwqGSKno2mLU9idC6NA9uZzqTsRC7a9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386423" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id D81D9180001CD for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 53D53CBEF7D; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 23/27] python3-git: fix CVE-2026-78675 Date: Fri, 6 Nov 2026 06:43:27 -0800 Message-Id: <20261106144331.3354811-24-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249681 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c [2] https://security-tracker.debian.org/tracker/CVE-2026-78675 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. --- .../python/python3-git/CVE-2026-78675.patch | 47 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch new file mode 100644 index 0000000000..0cef9a19b0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch @@ -0,0 +1,47 @@ +From eaa63265a59f069bf13384481c48fa48a25ff087 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 10 Aug 2026 12:32:24 +0200 +Subject: [PATCH] fix: ignore includes in submodule configuration + + +Submodule configuration is read from .gitmodules, whose contents may come +from an untrusted repository. Its parser inherited merge_includes=True and +could therefore open files named by include directives during ordinary +submodule enumeration. + +Disable include merging at the SubmoduleConfigParser construction site. This +matches Repo.config_writer() hardening from 41ecc6a4 and addresses +GHSA-7833-fr7j-v32q without changing include behavior for trusted config +parsers. + +The regression points .gitmodules at a non-config file and verifies the +submodule entry remains readable without opening the included path. + +CVE: CVE-2026-78675 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c] + +Backport Changes: +- Omitted test/test_submodule.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit ef7568e3b317ce617eacda39b8b54dcdff8c3b5c) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py +index 410f41e2..e37f8fa9 100644 +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -268,7 +268,7 @@ class Submodule(IndexObject, TraversableIterableObj): + raise ValueError("Cannot write blobs of 'historical' submodule configurations") + # END handle writes of historical submodules + +- return SubmoduleConfigParser(fp_module, read_only=read_only) ++ return SubmoduleConfigParser(fp_module, read_only=read_only, merge_includes=False) + + def _clear_cache(self) -> None: + """Clear the possibly changed values.""" diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index badbf04415..0dd42e1f04 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -47,6 +47,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78678_CVE-2026-78679.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ + file://CVE-2026-78675.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103278 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7343.1793976215204878691 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=eJvAP+em; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=19416; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=KOhuz3cjhgUENidZvWzNC/bN18SDZ+0CvsYiItEnthg=; b=eJvAP+emdIPhcYmJ2m6/YjVm7kxZ386SbgFIcHXDzB2bF7fqMsHXzjaP cvlCN9Rul+7iblIVf3VEEvDc8qc6Q6gNN/WAJ2KVXLkRIpBmzRp0LYwxv XOFHbNRB1vDHkEyc+VBRynpW/5b04N5fCMRGpGDE7cBYik3O0Aq4yijKn tGcxIReyHNwSB+6u9VYoWC8WSxm1ZpjQomghTukK41K+GVrK2IFqUx3f6 x8LBUfa+vN631UnFOuZTbALf0NStzm44v1NlOXry1G5Br5Skr8AC8HgKZ 7fjB0q/39RlphCT1hOegZ/4kCU0I1bRVkNlQKow5DRP1v0jxIaUeXbAP/ A==; X-CSE-ConnectionGUID: T5pSOWqySHicKilN6IRtcA== X-CSE-MsgGUID: yvM54Hj9QQS5d4vXpIXJ6w== X-IPAS-Result: A0BPAgAQ5u1q/47/Ja1aHgEBCxIMggULgld1YENJA4RUj1OCIQORTIFUiwEUgWoPAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0cAwECAwIRFQICKx0BBQgZHoJkAYI6AzcDEbw/en8zgQGDKQE/AkNQ2EwQb4FoAQsUAYEKLoVCgyABhQNdGAGEfScbgUlEgRWBO4IugQWBXAKBGS0EVYMdgmoEgxwSgVqBA4wVAoFRhnlIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPQFuB5I9gkU7CwcBPBs2ASsXegcDBS0YEwULAwgZBQwRApMRAQIHkjehEYQqjCSHJ44TGjOEBIFXkkKSVAuYfY4KlTUwBAsQTYRpgWg8Rn0PBzMaCBsVO4JnCUoZD44rAgwLg2CFE1HGCCYyAgkDLwEBBwIHDgMLgWiQAQEmB4FPAQE IronPort-Data: A9a23:tBlxhat1/6wc3c3yBAZwl+K36+fnVAFfMUV32f8akzHdYApBsoF/q tZmKT2CO6mPZWShe9EnbYnnpkxT7cTXx9VgTwY/qyhjEiwXgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Us21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIwxrtvOkZx7 O0jCDEGTRGHobyX+q6wY7w57igjBJGD0II3oHpsy3TdSP0hW52GG/iM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtNYH49tL/Aan3XYiBCoV6YjaE2+GPUigd21dABNfKIJoDTFJoIzx3wS mTu7nrcX006No2m8AHY/i6ytvfurQGlR9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cE3hKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:p1VYdKPvKihmZcBcTuOjsMiBIKoaSvp037BN7TEXdfU1SL39qy nAppomPHPP5Qr5HUtQ+uxoW5PwJE80i6QV3WB5B97LN2PbUSmTXeNfBODZrAEIdReTygck78 ddWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IHjJ7MHd3ATV0mmhD0JczqmLg== X-Talos-CUID: 9a23:FmJXn2/j7zFIFtyYPLGVv3JJAvsCTWTM91fRKGy5DUA3aYeJQnbFrQ== X-Talos-MUID: 9a23:2qRs1Ao3KG/l7vzH3WYezyB8EZo0w6b/MXk2zJlapfmcFBxSZSjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544197593" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id D92CB180007F1 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 5B959CC4D0E; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 24/27] python3-git: fix CVE-2026-87817 Date: Fri, 6 Nov 2026 06:43:28 -0800 Message-Id: <20261106144331.3354811-25-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249686 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b [2] https://security-tracker.debian.org/tracker/CVE-2026-87817 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker and corrected the embedded From hash to the cited upstream commit. Added the missing re import. Updated alternates lookup to use self.odb.root_path(); moved Cygwin and relative-path handling in find_submodule_git_dir() and return a path only when is_git_dir() validates it. Expanded Backport Changes to describe the GitPython 3.1.43 adaptations and omitted documentation/tests. --- .../python/python3-git/CVE-2026-87817.patch | 443 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 444 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch new file mode 100644 index 0000000000..fc604ca44f --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87817.patch @@ -0,0 +1,443 @@ +From c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 25 Aug 2026 04:57:29 +0200 +Subject: [PATCH] fix: prefer `.git` during repository discovery + + +GitPython considered worktree administration and bare-repository signatures +before a worktree's real .git entry. Align discovery with Git so .git files +and directories win, malformed .git files stop discovery, and candidate git +directories validate HEAD plus commondir-backed object and ref storage. This +addresses GHSA-239g-whfq-7xj9. + +Regression coverage compares ambiguous layouts with git rev-parse and rejects +invalid HEAD/.git metadata. + +Git baseline: 15c6308cf7ad276b306aa5b3ababfbdebfb1a917; setup.c +setup_git_directory_gently_1(), is_git_directory(), and validate_headref(). + +Repository validation can use GIT_COMMON_DIR for refs and objects. Preserve the +same value on Repo so later config, ref, and object access uses the directory +that made discovery succeed. + +Capture GIT_COMMON_DIR before the first repository config read so bare-state +detection uses the same metadata location as discovery. Resolve relative +environment values immediately so later working-directory changes cannot +retarget the Repo. + +Review feedback: relative GIT_COMMON_DIR left Git subprocesses resolving GIT_DIR +and GIT_COMMON_DIR from a different working directory; malformed commondir data, +empty GIT_OBJECT_DIRECTORY, and the linked-worktree signature were also handled +inconsistently. + +Pin the repository environment to resolved paths, reject invalid +metadata without consulting the process working directory, and +restore HEAD-based linked-worktree detection. Keep the loose HEAD +and dangling .git behavior because both match Git setup.c at baseline +15c6308cf7ad276b306aa5b3ababfbdebfb1a917. + +Review feedback identified that chained or self-referential .git pointers +recurse, filesystem-encoded metadata can fail text decoding, and a relative +GIT_DIR is not retained for later Git commands. + +Parse one regular, size-bounded Gitfile exactly once, decode Gitfile and +commondir paths with the filesystem codec, and retain the resolved GIT_DIR +for subprocesses. This rejects cycles like Git instead of recursing and keeps +commands stable after working-directory changes. + +Review feedback noted that a dangling commondir symlink was treated as absent, +allowing local objects and refs to validate the repository. + +Distinguish a truly missing commondir from a dangling symlink. This follows +Git's get_common_dir_noenv(), whose file_exists check uses lstat before +attempting to read the entry. + +Python 3.9 on Windows raised UnicodeDecodeError while the repository-discovery +regression test parsed invalid commondir bytes, causing the Python package test +(windows, 3.9) check to fail. + +Treat UnicodeError like an unreadable metadata file in both commondir and +gitfile parsing. Invalid bytes now make discovery reject the candidate +repository, matching Git's behavior. + +Review feedback noted that GIT_OBJECT_DIRECTORY made discovery succeed without +becoming the Repo ODB root, while a relative value could later be resolved from +the Git wrapper's different working directory. + +Resolve the environment value against the construction directory, use it as the +ODB root, and preserve the absolute value for later Git commands. The regression +moves the only object store outside the git directory and verifies access +through both GitDB and git cat-file after the original environment and current +directory are restored. + +Review feedback identified four setup mismatches: non-missing .git stat failures +could fall through to another repository, explicit GIT_DIR could be redirected +through a nested .git entry, Gitfile reads were not bounded to the stat-reported +size, and alternates ignored GIT_OBJECT_DIRECTORY. + +Match Git setup.c by bypassing discovery for an environment-selected GIT_DIR, +stopping discovery when Gitfile stat fails for reasons other than a missing +path, and reading exactly the previously observed Gitfile size. Resolve +alternates below the active ODB root so custom object stores remain internally +consistent. + +The commit review noted that treating every present GIT_DIR as explicit broke +two documented cases: an empty GIT_DIR must fall back to current-directory +discovery, while an empty Repo path must still use a nonempty GIT_DIR. + +CVE: CVE-2026-87817 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b] + +Backport Changes: +- Omitted doc/source/changes.rst because its upstream hunk is a + release-note entry; the file is present in the recipe PyPI archive. +- Adapted the repository-discovery and environment-handling changes to + GitPython 3.1.43’s Repo.__init__ implementation. This includes its + linked-worktree and .git discovery flow, resolving and preserving + GIT_DIR/GIT_COMMON_DIR, and using GIT_OBJECT_DIRECTORY as the object + database root. These version-specific changes account for the difference + in git/repo/base.py from upstream; the alternates accessor changes are + part of that adaptation. +- Added the standard-library re import in git/repo/fun.py because the + upstream re.match() call relies on an import from an earlier commit that + is absent from GitPython 3.1.43. +- Omitted test/test_repo.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does + not run it. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b) +Signed-off-by: Yogita Urade +--- + git/repo/base.py | 91 +++++++++++++++++++++++++++++++-------------- + git/repo/fun.py | 111 +++++++++++++++++++++++++++++++++++++----------------- + 2 files changed, 135 insertions(+), 67 deletions(-) + +diff --git a/git/repo/base.py b/git/repo/base.py +index e3b10459..a5532ae5 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -45,7 +45,6 @@ Repo imports + + from .fun import ( + find_submodule_git_dir, +- find_worktree_git_dir, + is_git_dir, + rev_parse, + touch, +@@ -231,6 +230,10 @@ Repo.__init__ reftable note + ) -> None: + R"""Create a new :class:`Repo` instance. + ++ .. note:: ++ Repositories using reftable may be opened, but GitPython's direct reference ++ access does not support reftable. ++ + :param path: + The path to either the root git directory or the bare git repo:: + +@@ -265,7 +268,11 @@ Repo.__init__ environment paths + :class:`Repo` + """ + +- epath = path or os.getenv("GIT_DIR") ++ git_dir_env = os.getenv("GIT_DIR") ++ object_dir_env = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir_env is not None: ++ object_dir_env = osp.abspath(object_dir_env) ++ epath = path or git_dir_env + if not epath: + epath = os.getcwd() + if Git.is_cygwin(): +@@ -289,15 +296,47 @@ Repo.__init__ repository discovery + raise NoSuchPathError(epath) + + # Walk up the path to find the `.git` dir. +- curpath = epath +- git_dir = None ++ curpath = os.fspath(epath) if epath is not None else "" ++ git_dir: Optional[str] = None ++ explicit_git_dir = not path and bool(git_dir_env) + while curpath: + # ABOUT osp.NORMPATH + # It's important to normalize the paths, as submodules will otherwise + # initialize their repo instances with paths that depend on path-portions + # that will not exist after being removed. It's just cleaner. ++ if not explicit_git_dir: ++ dotgit = osp.join(curpath, ".git") ++ try: ++ sm_gitpath = find_submodule_git_dir(dotgit) ++ except OSError: ++ break ++ if sm_gitpath is not None: ++ # Worktrees can use relative paths as of Git 2.48, so join to curpath. ++ git_dir = osp.normpath(osp.join(curpath, os.fspath(sm_gitpath))) ++ self._working_tree_dir = curpath ++ break ++ ++ # Like Git, do not fall back to a bare repository or parent directory when ++ # a non-directory .git entry exists but is not a valid gitfile. ++ if osp.exists(dotgit) and not osp.isdir(dotgit): ++ break + if is_git_dir(curpath): + git_dir = curpath ++ if osp.isfile(osp.join(curpath, "gitdir")) and osp.isfile(osp.join(curpath, "commondir")): ++ if "GIT_WORK_TREE" in os.environ: ++ self._working_tree_dir = os.getenv("GIT_WORK_TREE") ++ else: ++ # Linked worktree administrative directories store the path to ++ # the worktree's .git file in gitdir (without a "gitdir: " prefix). ++ with open(osp.join(git_dir, "gitdir")) as fp: ++ worktree_gitfile = fp.read().strip() ++ ++ if not osp.isabs(worktree_gitfile): ++ worktree_gitfile = osp.normpath(osp.join(git_dir, worktree_gitfile)) ++ ++ self._working_tree_dir = osp.dirname(worktree_gitfile) ++ break ++ + # from man git-config : core.worktree + # Set the path to the root of the working tree. If GIT_COMMON_DIR + # environment variable is set, core.worktree is ignored and not used for +@@ -317,21 +356,7 @@ Repo.__init__ directory search + self._working_tree_dir = os.getenv("GIT_WORK_TREE") + break + +- dotgit = osp.join(curpath, ".git") +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is not None: +- git_dir = osp.normpath(sm_gitpath) +- +- sm_gitpath = find_submodule_git_dir(dotgit) +- if sm_gitpath is None: +- sm_gitpath = find_worktree_git_dir(dotgit) +- +- if sm_gitpath is not None: +- git_dir = expand_path(sm_gitpath, expand_vars) +- self._working_tree_dir = curpath +- break +- +- if not search_parent_directories: ++ if explicit_git_dir or not search_parent_directories: + break + curpath, tail = osp.split(curpath) + if not tail: +@@ -342,6 +367,16 @@ Repo.__init__ common directory + raise InvalidGitRepositoryError(epath) + self.git_dir = git_dir + ++ common_dir_env = os.getenv("GIT_COMMON_DIR") ++ if common_dir_env is not None: ++ self._common_dir = osp.abspath(common_dir_env) ++ else: ++ try: ++ common_dir = os.fsdecode((Path(self.git_dir) / "commondir").read_bytes()).rstrip("\r\n") ++ self._common_dir = osp.join(self.git_dir, common_dir) ++ except OSError: ++ self._common_dir = "" ++ + self._bare = False + try: + self._bare = self.config_reader("repository").getboolean("core", "bare") +@@ -349,12 +384,6 @@ Repo.__init__ bare-state detection + # Let's not assume the option exists, although it should. + pass + +- try: +- common_dir = (Path(self.git_dir) / "commondir").read_text().splitlines()[0].strip() +- self._common_dir = osp.join(self.git_dir, common_dir) +- except OSError: +- self._common_dir = "" +- + # Adjust the working directory in case we are actually bare - we didn't know + # that in the first place. + if self._bare: +@@ -363,9 +392,15 @@ Repo.__init__ Git environment and object database + + self.working_dir: PathLike = self._working_tree_dir or self.common_dir + self.git = self.GitCommandWrapperType(self.working_dir) ++ if common_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir), GIT_COMMON_DIR=os.fspath(self.common_dir)) ++ elif git_dir_env is not None: ++ self.git.update_environment(GIT_DIR=os.fspath(self.git_dir)) ++ if object_dir_env is not None: ++ self.git.update_environment(GIT_OBJECT_DIRECTORY=object_dir_env) + + # Special handling, in special times. +- rootpath = osp.join(self.common_dir, "objects") ++ rootpath = object_dir_env if object_dir_env is not None else osp.join(self.common_dir, "objects") + if issubclass(odbt, GitCmdObjectDB): + self.odb = odbt(rootpath, self.git) + else: +@@ -952,7 +987,7 @@ Repo._get_alternates + List of strings being pathnames of alternates + """ + if self.git_dir: +- alternates_path = osp.join(self.git_dir, "objects", "info", "alternates") ++ alternates_path = osp.join(self.odb.root_path(), "info", "alternates") + + if osp.exists(alternates_path): + with open(alternates_path, "rb") as f: +@@ -973,7 +1008,7 @@ Repo._set_alternates + The method does not check for the existence of the paths in `alts`, as the + caller is responsible. + """ +- alternates_path = osp.join(self.common_dir, "objects", "info", "alternates") ++ alternates_path = osp.join(self.odb.root_path(), "info", "alternates") + if not alts: + if osp.isfile(alternates_path): + os.remove(alternates_path) + +diff --git a/git/repo/fun.py b/git/repo/fun.py +index e44d9c64..30c30ebb 100644 +--- a/git/repo/fun.py ++++ b/git/repo/fun.py +@@ -20,5 +20,6 @@ standard-library imports + import os + import os.path as osp ++import re + from pathlib import Path + import stat + from string import digits +@@ -57,22 +58,61 @@ is_git_dir repository validation + def is_git_dir(d: PathLike) -> bool: + """This is taken from the git setup.c:is_git_directory function. + ++ .. note:: ++ This function recognizes repositories using reftable through their ++ compatibility files, but GitPython's direct reference access does not support ++ reftable. ++ + :raise git.exc.WorkTreeRepositoryUnsupported: + If it sees a worktree directory. It's quite hacky to do that here, but at least + clearly indicates that we don't support it. There is the unlikely danger to + throw if we see directories which just look like a worktree dir, but are none. + """ + if osp.isdir(d): +- if (osp.isdir(osp.join(d, "objects")) or "GIT_OBJECT_DIRECTORY" in os.environ) and osp.isdir( +- osp.join(d, "refs") +- ): +- headref = osp.join(d, "HEAD") +- return osp.isfile(headref) or (osp.islink(headref) and os.readlink(headref).startswith("refs")) +- elif ( +- osp.isfile(osp.join(d, "gitdir")) +- and osp.isfile(osp.join(d, "commondir")) +- and osp.isfile(osp.join(d, "gitfile")) +- ): ++ headref = osp.join(d, "HEAD") ++ if osp.islink(headref): ++ try: ++ valid_head = os.readlink(headref).startswith("refs/") ++ except OSError: ++ valid_head = False ++ else: ++ try: ++ with open(headref, "rb") as fp: ++ head = fp.read(256) ++ except OSError: ++ valid_head = False ++ else: ++ valid_head = (head.startswith(b"ref:") and head[4:].lstrip().startswith(b"refs/")) or bool( ++ re.match(rb"(?:[0-9A-Fa-f]{64}|[0-9A-Fa-f]{40})", head) ++ ) ++ ++ common_dir = os.getenv("GIT_COMMON_DIR") ++ if common_dir == "": ++ return False ++ if common_dir is None: ++ common_dir_file = Path(d) / "commondir" ++ try: ++ common_dir = os.fsdecode(common_dir_file.read_bytes()).rstrip("\r\n") ++ except FileNotFoundError: ++ if osp.lexists(common_dir_file): ++ return False ++ common_dir = os.fspath(d) ++ except (OSError, UnicodeError): ++ return False ++ else: ++ if not common_dir: ++ return False ++ try: ++ common_dir = osp.realpath(osp.join(d, common_dir)) ++ except (OSError, ValueError): ++ return False ++ ++ object_dir = os.getenv("GIT_OBJECT_DIRECTORY") ++ if object_dir is None: ++ object_dir = osp.join(common_dir, "objects") ++ if valid_head and osp.isdir(object_dir) and osp.isdir(osp.join(common_dir, "refs")): ++ return True ++ if osp.isfile(osp.join(d, "gitdir")) and osp.isfile(osp.join(d, "commondir")) and osp.isfile(headref): + raise WorkTreeRepositoryUnsupported(d) + return False + +@@ -81,19 +121,20 @@ find_worktree_git_dir bounded Gitfile parsing + """Search for a gitdir for this worktree.""" + try: + statbuf = os.stat(dotgit) +- except OSError: ++ except (FileNotFoundError, NotADirectoryError): + return None +- if not stat.S_ISREG(statbuf.st_mode): ++ if not stat.S_ISREG(statbuf.st_mode) or statbuf.st_size > (1 << 20): + return None + + try: +- lines = Path(dotgit).read_text().splitlines() +- for key, value in [line.strip().split(": ") for line in lines]: +- if key == "gitdir": +- return value +- except ValueError: +- pass +- return None ++ with open(dotgit, "rb") as fp: ++ content_bytes = fp.read(statbuf.st_size) ++ if len(content_bytes) != statbuf.st_size: ++ return None ++ content = os.fsdecode(content_bytes).rstrip("\r\n") ++ except (OSError, UnicodeError): ++ return None ++ return content[8:] if len(content) >= 9 and content.startswith("gitdir: ") else None + + + def find_submodule_git_dir(d: PathLike) -> Optional[PathLike]: +@@ -101,26 +142,18 @@ find_submodule_git_dir validated Gitfile resolution + if is_git_dir(d): + return d + +- try: +- with open(d) as fp: +- content = fp.read().rstrip() +- except IOError: +- # It's probably not a file. +- pass +- else: +- if content.startswith("gitdir: "): +- path = content[8:] +- +- if Git.is_cygwin(): +- # Cygwin creates submodules prefixed with `/cygdrive/...` suffixes. +- # Cygwin git understands Cygwin paths much better than Windows ones. +- # Also the Cygwin tests are assuming Cygwin paths. +- path = cygpath(path) +- if not osp.isabs(path): +- path = osp.normpath(osp.join(osp.dirname(d), path)) +- return find_submodule_git_dir(path) +- # END handle exception +- return None ++ path = find_worktree_git_dir(d) ++ if path is None: ++ return None ++ ++ if Git.is_cygwin(): ++ # Cygwin creates submodules prefixed with `/cygdrive/...`. ++ # Cygwin git understands Cygwin paths much better than Windows ones. ++ # Also the Cygwin tests are assuming Cygwin paths. ++ path = cygpath(path) ++ if not osp.isabs(path): ++ path = osp.normpath(osp.join(osp.dirname(d), path)) ++ return path if is_git_dir(path) else None + + + def short_to_long(odb: "GitCmdObjectDB", hexsha: str) -> Optional[bytes]: diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 0dd42e1f04..558846a950 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -48,6 +48,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78677.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ + file://CVE-2026-87817.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103280 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7336.1793976213937852288 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=QRXmpLHI; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3702; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=gDp/I7DfWN8ZokS8D1eY8PlIfXX+L266MQxpAYOoCdI=; b=QRXmpLHI8oh/q2nbHZ1qNlEA11w027cyFVuyL6MCSRkECFLusLNUjAXz nrcTP/XFqT/sbjhPfwPdkxYmtxfVeh5X95HU4VrX8IJrHBX24C7UJm6b/ HJmYoBR+wRumHkAn7dhCFUPXjtRqe/vQz3Iq/3teZKxbOYN7JSwzV02in 8N0jcQViCSAkCYvQXCLGKjN886ntfsfcKoQGaa5/U8GoNdasmBinDrClq b/QMFVzK8VNMv9c7mXS2mYL6JBLjWRrJOjDFeIa+tBfVcF1PfE++OIKrm wEeR50TkEs+EsF1z0siVoyn+w49CdizEITKrZ94FFmX76r7X1T1ANTweQ w==; X-CSE-ConnectionGUID: Id67lbqnQh2B51FQEjlFdw== X-CSE-MsgGUID: ii3f/uL0RyuE4lWi1pwESw== X-IPAS-Result: A0BJAgAQ5u1q/5L/Ja1aglmCV3VgQ0kDlCeCIQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCOgM3AxG8P4F5M4EBgykBPwJDUNhMEG+BaAELFAGBOIVCiCRdGAGEfScbgUlEgRWDaYEFgVwCiCYEgxwSgVqNGAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CHyY7EQE9UQErggMpTpJXklGhEYQqjCSVOhozhASBV5JCklQLmH2OCpZRhGmBaDyBRA4HMxoIGxWDIglKGQ+OOYNrhRNRxggmMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:ijhrL6i7Yqa6HHdgBFLTL7qCX161NxEKZh0ujC45NGQN5FlHY01je htvC2jTPqzZMWD8eN90OYy+phgA75TTx4c3HQtvqy5hFyNjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvre8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU59rgoBWtX8 8UYchpQNz66quCy7r6kH7wEasQLdKEHPasFsX1miDWcBvE8TNWbEuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgl/5JEWxI9EglHubidRpF+9rqss6G+Vxwt0uFToGIeJJ4faG5kPwi50o ErH/j/3RQw+bOaO1BfZ9k2t3/fQsBjkDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBVCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:L0O6U6HlPHRPQ/H3pLqExMeALOsnbusQ8zAXPidKOHhom6Oj+f xG8M536fawskdzZJhCo6HkBED/exLhHPdOiOF7V4tKHjOW2ldAR7sM0WKN+VHd8lXFltJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:kTlJdWpEy6/CD7kpcpItFBLmUeEpLCLZxm7WGk/iIzswZoS4S1u+9Lwxxg== X-Talos-MUID: 9a23:d+ZqhQVrsOkpjSrq/D7t3z8lKeMw2bWzJRwJrpRfo9apDjMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545386424" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id DB04A1800023E for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 62F5BCC8C85; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 25/27] python3-git: fix CVE-2026-87818 Date: Fri, 6 Nov 2026 06:43:29 -0800 Message-Id: <20261106144331.3354811-26-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249684 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8 [2] https://security-tracker.debian.org/tracker/CVE-2026-87818 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Added the omitted doc/source/changes.rst release-note change to Backport Changes. --- .../python/python3-git/CVE-2026-87818.patch | 55 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 56 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch new file mode 100644 index 0000000000..0e78580651 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch @@ -0,0 +1,55 @@ +From 6b83f54db287f190ae29c89b36ba6aba01f7c8d6 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Mon, 17 Aug 2026 06:15:12 +0200 +Subject: [PATCH] fix: require opt-in for no-index diffs + + +Treat --no-index as an unsafe diff option because it changes path operands +from repository pathspecs to arbitrary filesystem paths. This addresses +GHSA-whh4-5q6c-9v3x without exposing advisory reproduction details. + +CVE: CVE-2026-87818 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8] + +Backport Changes: +- Omitted test/test_diff.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does +- Omitted doc/source/changes.rst file changes. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 09f2cf383a992d1af697364569e9f384748c1bd8) +Signed-off-by: Yogita Urade +--- + git/diff.py | 4 ++-- + git/repo/base.py | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/git/diff.py b/git/diff.py +index 032dfb25..08bd4410 100644 +--- a/git/diff.py ++++ b/git/diff.py +@@ -216,8 +216,8 @@ class Diffable: + to be read and diffed. + + :param allow_unsafe_options: +- If ``True``, allow options such as ``--output`` and ``-O`` that can write to +- or read from arbitrary filesystem paths. ++ If ``True``, allow options such as ``--output``, ``--no-index``, and ``-O`` ++ that can write to or read from arbitrary filesystem paths. + + :param kwargs: + Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to +diff --git a/git/repo/base.py b/git/repo/base.py +index 7543e3cc..f2dca3c7 100644 +--- a/git/repo/base.py ++++ b/git/repo/base.py +@@ -203,6 +203,8 @@ class Repo: + ] + + unsafe_git_diff_options = unsafe_git_revision_options + [ ++ # Treats path operands as arbitrary filesystem paths. ++ "--no-index", + # Reads caller-controlled order patterns from an arbitrary file. + "-O", + "--orderfile", diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 558846a950..efd17b45c4 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -49,6 +49,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78676.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ + file://CVE-2026-87818.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103283 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7340.1793976214807337239 for ; Fri, 06 Nov 2026 06:43:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=QP/Tnwjp; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10759; q=dns/txt; s=iport01; t=1793976215; x=1795185815; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=FepKbQR/0LVeeWOcVLVV/exQoOcalfeyCaXX1Ej/MaU=; b=QP/TnwjpQgFh0dtNUBmV7WWcVANARdR6JLrY4HOmTn7mhheijLjv8D4z TjvMcxG2AcfA9D2p8ETQCpCUe9Oby+5yzLFr6L+YsyMkWoM3a6+8ju26T zKXGcErKBgHwTq89HJlM4auvONB2h5K5D05RLEUUJHCzZK3KtvF/JJ//Y q7kigf3ap8xSupnGokTTfW5pUhGJOdsd+s6mSK81A8NAeSyr4PSrgZnU4 mZVXladyrqCrPxNK31JFU/hgIu1uVuh8/1kGkeJIby22m6sqRzJVVosqF kFI6gPw/jNX7vwlf61BMpWbuWysxR+2gugmXhAXi1SKm4X5lvDoGfiUnv A==; X-CSE-ConnectionGUID: NEFl3y3UQ5W5kzaFjnNr6w== X-CSE-MsgGUID: GTKWtvgQT4ij8ckHc4xDFQ== X-IPAS-Result: A0AnAACS5u1q/4z/Ja1RCR0BAQEBCQESAQUFAYF8CAELAYJWdWBDSQOMb4c4gTVsA5MgiwEUgWoPAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxFgXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4AYVBiCRdGAFEhDknG4FJRIEVg2mBBUsBgRACgSsBCAoBB4ZgBIMcEoFagQyMDAKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CChYlLRkGAQE8GzYBBx4GFz+BNQgZkzUCCJAWgiGhEYQqjCSVOhozhASBV5JCklQLmH2OCpVpMTeEaYFoPGlwMxoIGxWDIglKGQ+OOYFjggiFE1FsxRwmMgIJAy8BAQcCBw4DC4FokAItgU8BAQ IronPort-Data: A9a23:ip2bDKzg3qW7fAW0LFx6t+dgxyrEfRIJ4+MujC+fZmUNrF6WrkUAn WcbCzyDbP6CYzejKdskb9m290pT7JfUxtA3GlFtqVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGcbE4lD671KODxxq P8KIR4PaDaZ2f3jldpXSsE07igiBNPgMIVavjRryivUSK59B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cO3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeSxYIWOJ4XQLSlTtmmkh V3a4WvAPk0bNoyUyhqOrmKAqNaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu13fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:5/mV1airQtkR90zEmWwdKVIlFnBQXvYji2hC6mlwRA09TyX+rb HLoB1173HJYVoqNU3I3OrwW5VoIkmskKKdn7NxAV7KZmCP0wGVxcNZnOnfKlbbdBEWmNQw6U 4ZSchDIey1K0RmhsDn5wT9OdMhzN6btJ2Mv47lvhBQpcUAUdAY0++/YTzrdHFLeA== X-Talos-CUID: 9a23:FtHCQmFvTC8j1tCWqmJB2WAQQdF+T0SA8yrTMUaWC2BPUuOKHAo= X-Talos-MUID: 9a23:q9BOLgnASr5zfvXEUkLsdnpNCORX/7qhMXxRkJdWsMqkPnBgFxmk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544873512" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id DD94B18000631 for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 6A663CC8C92; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 26/27] python3-git: Fix CVE-2026-87819 Date: Fri, 6 Nov 2026 06:43:30 -0800 Message-Id: <20261106144331.3354811-27-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249682 This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8 [2] https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f [3] https://security-tracker.debian.org/tracker/CVE-2026-87819 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Added the omitted release-note change to p1. In p2, restored comments identifying the Actor.from_string and review-follow-up changes, and moved the Co-authored-by trailer into the commit-message trailer block. --- .../python3-git/CVE-2026-87819_p1.patch | 78 ++++++++++ .../python3-git/CVE-2026-87819_p2.patch | 146 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 2 + 3 files changed, 226 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch new file mode 100644 index 0000000000..8d5566c19c --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch @@ -0,0 +1,78 @@ +From 47e0d430af6885ceeaa38a8c5517efac872b70b4 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 11 Aug 2026 14:18:25 +0200 +Subject: [PATCH] fix: parse actor identities without regular expressions + + +GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor +identity contains a long unterminated email delimiter. + +Add a regression that exercises a 20,000-character malformed identity, +then replace both actor regexes with direct delimiter scans following +Git's first-opening, first-closing delimiter behavior. Keep GitPython's +whole-string fallback when either delimiter is absent. + +Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95 +ident.c::split_ident_line and its invalid-committer cases in +t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and +lenient identity tests. + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8] + +Backport Changes: +- Omitted test/test_actor.py because the current PyPI source + archive does not include the test suite and the python3-git + recipe does not run it. +- Omitted doc/source/changes.rst file changes. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 751473a5f3221d6f989291cbebcc404353fd3ba8) +Signed-off-by: Yogita Urade +--- + git/util.py | 24 ++++++++---------------- + 1 file changed, 8 insertions(+), 16 deletions(-) + +diff --git a/git/util.py b/git/util.py +index 9619937c..9a698e6d 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -772,10 +772,6 @@ class Actor: + committers and authors or anything with a name and an email as mentioned in the git + log entries.""" + +- # PRECOMPILED REGEX +- name_only_regex = re.compile(r"<(.*)>") +- name_email_regex = re.compile(r"(.*) <(.*?)>") +- + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +@@ -820,18 +816,14 @@ class Actor: + :return: + :class:`Actor` + """ +- m = cls.name_email_regex.search(string) +- if m: +- name, email = m.groups() +- return Actor(name, email) +- else: +- m = cls.name_only_regex.search(string) +- if m: +- return Actor(m.group(1), None) +- # Assume the best and use the whole string as name. +- return Actor(string, None) +- # END special case name +- # END handle name/email matching ++ line = string.partition("\n")[0] ++ left_bracket = line.find("<") ++ right_bracket = line.find(">", left_bracket + 1) ++ if left_bracket >= 0 and right_bracket >= 0: ++ return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) ++ ++ # Assume the best and use the whole string as name. ++ return Actor(string, None) + + @classmethod + def _main_actor( diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch new file mode 100644 index 0000000000..cf5d931830 --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch @@ -0,0 +1,146 @@ +From 0d63f66a673cfcad25a1fd85f56177d19a1b6547 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Fri, 28 Aug 2026 08:37:50 +0200 +Subject: [PATCH] fix: restore Actor.name_email_regex (#2220) + + +GitPython 3.1.60 removed the Actor.name_email_regex class attribute while +replacing internal actor parsing, which broke downstream consumers such as +python-semantic-release. + +Bring back the historical compiled pattern for downstream compatibility, +but emit DeprecationWarning whenever the class member is accessed. The warning +explains its quadratic behavior on long malformed strings and points callers to +the public Actor(name, email) constructor when fields are separate, or direct +string parsing when they are not. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 + +# 252a84ac Add public Actor.from_string constructor (#2220) + +Add public Actor.from_string constructor (#2220) + +Promote the existing actor identity parser to Actor.from_string while retaining _from_string as a compatibility alias. Point the name_email_regex deprecation warning to the new public constructor or Actor(name, email). + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 12 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +Co-authored-by: Codex GPT-5 + +# dd2181d8 Address review feedback about Actor subclasses + +Address review feedback about Actor subclasses + +Review feedback: Actor.from_string() should preserve the class on which the public classmethod is called instead of always returning a base Actor. + +Construct through cls on both parsing paths and cover subclass construction directly. + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 13 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +# fcf1ecb1 Address review feedback about constructor typing + +Address review feedback about constructor typing + +Review feedback: Actor.from_string() constructs subclasses at runtime but its Actor return annotation prevents type checkers from preserving subclass-specific members. + +Use the project existing Python 3.7-compatible bound TypeVar pattern so the declared return type follows cls. + +Validation: +- actor-related test/test_actor.py and test/test_util.py cases: 13 passed +- ruff check and format checks passed +- basedpyright git/util.py: no errors + +Co-authored-by: Codex GPT-5 + +CVE: CVE-2026-87819 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f] + +Backport Changes: +- Omitted test/test_actor.py because the current PyPI source archive + does not include the test suite and the python3-git recipe does not + run it. + +(cherry picked from commit bc63b027e2fc737e2ec0222bfa764e1aa76a427f) +Signed-off-by: Yogita Urade +--- + git/util.py | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/git/util.py b/git/util.py +index 9a698e6d..16cd25ef 100644 +--- a/git/util.py ++++ b/git/util.py +@@ -80,6 +80,7 @@ from typing import ( + Sequence, + Tuple, + TYPE_CHECKING, ++ Type, + TypeVar, + Union, + cast, +@@ -108,6 +109,7 @@ from git.types import ( + + T_IterableObj = TypeVar("T_IterableObj", bound=Union["IterableObj", "Has_id_attribute"], covariant=True) + # So IterableList[Head] is subtype of IterableList[IterableObj]. ++T_Actor = TypeVar("T_Actor", bound="Actor") + + _logger = logging.getLogger(__name__) + +@@ -767,11 +769,27 @@ class CallableRemoteProgress(RemoteProgress): + self._callable(*args, **kwargs) + + ++class _DeprecatedActorNameEmailRegex: ++ _pattern = re.compile(r"(.*) <(.*?)>") ++ ++ def __get__(self, _instance: Any, _owner: Any) -> Pattern[str]: ++ warnings.warn( ++ "Actor.name_email_regex is deprecated and will be removed in GitPython 4.0.0 because searching long " ++ "malformed strings with it can take quadratic time. Use Actor.from_string() to parse actor identities, " ++ "or Actor(name, email) when the fields are already separate.", ++ DeprecationWarning, ++ stacklevel=2, ++ ) ++ return self._pattern ++ ++ + class Actor: + """Actors hold information about a person acting on the repository. They can be + committers and authors or anything with a name and an email as mentioned in the git + log entries.""" + ++ name_email_regex = _DeprecatedActorNameEmailRegex() ++ + # ENVIRONMENT VARIABLES + # These are read when creating new commits. + env_author_name = "GIT_AUTHOR_NAME" +@@ -805,7 +823,7 @@ class Actor: + return '">' % (self.name, self.email) + + @classmethod +- def _from_string(cls, string: str) -> "Actor": ++ def from_string(cls: Type[T_Actor], string: str) -> T_Actor: + """Create an :class:`Actor` from a string. + + :param string: +@@ -820,10 +838,12 @@ class Actor: + left_bracket = line.find("<") + right_bracket = line.find(">", left_bracket + 1) + if left_bracket >= 0 and right_bracket >= 0: +- return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) ++ return cls(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket]) + + # Assume the best and use the whole string as name. +- return Actor(string, None) ++ return cls(string, None) ++ ++ _from_string = from_string + + @classmethod + def _main_actor( diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index efd17b45c4..1c77341132 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -50,6 +50,8 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-78675.patch \ file://CVE-2026-87817.patch \ file://CVE-2026-87818.patch \ + file://CVE-2026-87819_p1.patch \ + file://CVE-2026-87819_p2.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c" From patchwork Fri Nov 6 14:43:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 103302 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7521.1793976220823708730 for ; Fri, 06 Nov 2026 06:43:41 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=V9G8lNSj; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5527; q=dns/txt; s=iport01; t=1793976221; x=1795185821; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=uFziTky3YxaeS8gD6qeKkBaBI0OnWoTOaXZmVb/QPTU=; b=V9G8lNSjDaMgQQuYTsKMzO1b/xPP4/dtA8UtR/9vXgDFkecxhrF1Swhk Dr9N7na7FT2t70XB0bN3Bzo5h/yXXX+zP1I9SpYTE7p7wHWR3M7hcpI9H Tb0HqfveVxYASaduZETxpo1kTJP44JLDnll8Ue5KJGdruui5XQlmRAJtg 5rYA8RDojjJzerrYNPvMxPVog5nHpktb+2B1Pm+QRpmveMdodX71PHyt6 YXAntqXsGvaS7N+P5PoiNVydM3YXp1Vbuz7yYacL8BksW2OhRG7yjtDF4 52TIbYqYRjT9LJaS50ZbEegEW0MItJj8NONQZ6O/rzj4sUiwP4ohUaQtm A==; X-CSE-ConnectionGUID: QcZ+ZcWzReq1+O+y4WS84Q== X-CSE-MsgGUID: UkfQLt+tRFuxCJqv0tFbPQ== X-IPAS-Result: A0AnAAAN5+1q/43/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJA4xvhziCIQOTIIsBgX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBPRwDAQIvKyMIGYMCAYI6AzcDEbxNgXkzgQGDKQE/AkNQ2EwQb4FoAQsUAYE4AYVBiCRdGAFEglaBYycbgUlEgRWBF4JSgQWBXAKIJgSCDYEPEoFagyWJcwKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXiGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2CRU0BgQ0BKxc5gR0LNA8TGJJ7CpI3oRGEKowklToaM4QEgVeSQpJUC5h9glmLMZZRhGmBaDyBWTMaCBsVgyIJShkPjjmDa4UTUWzFHCYyAgkDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:rpyYcK1cxMl41s93L/bD5YRwkn2cJEfYwER7XKvMYLTBsI5bp2FSm mYXDGDUP6yOZWHzfohwYYjnpBhX7MDXzdNrGgBo3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmcsbzpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGNUoEfr8TxfRNDHgXt ttbOWwyVUDfvrfjqF67YrEEasULNsLnOsYb/3pn1zycVapgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUiZC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsjOSxb4SJJ4PiqcN9o0WWn 0bavHjDLAwKH/6G12KZ3HiUv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Mv0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXJIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:2Nmsuq+RyW8CRBfuY2huk+D0I+orL9Y04lQ7vn2ZLiYlFvBw+P rBoB1273LJYXMqKRIdcLO7Scy9qA3nlKKdiLN5VdzJYOClghrLEGgI1+TfKlPbdxEWjtQ86Y 5QN45jFdb3EV92yez+4AW+DpIc5ePvytHOuQ8bpE0dND2DrMpbnmFENjo= X-Talos-CUID: 9a23:1GfpsG1l14SdhYO1PHw5VLxfI8sXMU/W82XqLlbhSkEqWeGqcg/MwfYx X-Talos-MUID: 9a23:1a6lbgaNgG6xIeBTijzivRV+d9tSzbm+I2IUj80alcO8DHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544476457" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 14:43:34 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id DE93F180005CA for ; Fri, 6 Nov 2026 14:43:33 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 71805CC8C93; Fri, 6 Nov 2026 06:43:33 -0800 (PST) From: Yogita Urade To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose][v2 PATCH 27/27] python3-git: fix CVE-2026-100689 Date: Fri, 6 Nov 2026 06:43:31 -0800 Message-Id: <20261106144331.3354811-28-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106144331.3354811-1-yurade@cisco.com> References: <20261106144331.3354811-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 14:43:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249690 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 [2] https://security-tracker.debian.org/tracker/CVE-2026-100689 Signed-off-by: Yogita Urade --- Changes in v2: - Changed the advisory reference from NVD to Debian Security Tracker. Rewrote Backport Changes to explain that the GitPython 3.1.43 adaptation normalizes root and candidate paths and enforces containment with commonpath. --- .../python/python3-git/CVE-2026-100689.patch | 91 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 92 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch new file mode 100644 index 0000000000..807d97dcfc --- /dev/null +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch @@ -0,0 +1,91 @@ +From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001 +From: Byron +Date: Tue, 1 Sep 2026 11:33:19 +0200 +Subject: [PATCH] Reject submodule checkout paths outside the repository + +GHSA-59cr-6r3x-644w identifies that submodule update paths could reach +filesystem operations without the containment check already used by add and +move. + +Add a regression that proves update rejects a parent-directory checkout +path before cloning, and override Submodule.abspath to apply the shared +_to_relative_path guard for every filesystem consumer. + +Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index +paths, covered for parent traversal by t/t9300-fast-import.sh. + +CVE: CVE-2026-100689 +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093] + +Backport Changes: +- Adapted _to_relative_path for 3.1.43: normalize root and candidate paths + and enforce containment with commonpath, replacing the old prefix check + that allowed relative .. traversal. This extra validation is not in the + upstream hunk, which adds the Submodule.abspath override. +- Omitted doc/source/changes.rst because it only records the release note. +- Omitted test/test_submodule.py because the PyPI source archive does not + include the test suite. + +Assisted-by: GPT 5.6 +Co-authored-by: GPT 5.6 +(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093) +Signed-off-by: Yogita Urade +--- + git/objects/submodule/base.py | 46 +++++++++++++++++++++++++++++------------ + 1 file changed, 33 insertions(+), 13 deletions(-) + +--- a/git/objects/submodule/base.py ++++ b/git/objects/submodule/base.py +@@ -400,19 +400,39 @@ + path = path[:-1] + # END handle trailing slash + +- if osp.isabs(path) and parent_repo.working_tree_dir: +- working_tree_linux = to_native_path_linux(parent_repo.working_tree_dir) +- if not path.startswith(working_tree_linux): +- raise ValueError( +- "Submodule checkout path '%s' needs to be within the parents repository at '%s'" +- % (working_tree_linux, path) +- ) +- path = path[len(working_tree_linux.rstrip("/")) + 1 :] +- if not path: +- raise ValueError("Absolute submodule path '%s' didn't yield a valid relative path" % path) +- # END verify converted relative path makes sense +- # END convert to a relative path +- ++ root = parent_repo.working_tree_dir ++ if root: ++ drive, tail = osp.splitdrive(path) ++ separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep) ++ if drive and not tail.startswith(separators): ++ raise ValueError("Drive-relative path %r is not supported" % path) ++ ++ root_abs = osp.abspath(to_native_path_linux(root)) ++ path_abs = osp.abspath(osp.join(root_abs, path)) ++ try: ++ common_path = osp.commonpath([root_abs, path_abs]) ++ except ValueError as e: ++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) from e ++ if osp.normcase(common_path) != osp.normcase(root_abs): ++ raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) ++ ++ path = to_native_path_linux(osp.relpath(path_abs, root_abs)) ++ ++ if not path or path == ".": ++ raise ValueError("Submodule checkout path must not be the repository root") ++ ++ return path ++ ++ @property ++ def abspath(self) -> PathLike: ++ root = self.repo.working_tree_dir ++ if root is None: ++ return super().abspath ++ path = root ++ for component in self._to_relative_path(self.repo, self.path).split("/"): ++ path = join_path_native(path, component) ++ if osp.islink(path): ++ raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path) + return path + + @classmethod diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb index 1c77341132..170fe989d9 100644 --- a/meta/recipes-devtools/python/python3-git_3.1.43.bb +++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb @@ -52,6 +52,7 @@ SRC_URI += "file://CVE-2026-42284.patch \ file://CVE-2026-87818.patch \ file://CVE-2026-87819_p1.patch \ file://CVE-2026-87819_p2.patch \ + file://CVE-2026-100689.patch \ " SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"