[OE-core][wrynose][patch] python3-git: Fix CVE-2026-67326

[OE-core][wrynose][patch] python3-git: Fix CVE-2026-67326

[Vijay Anusuri]

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06
[2] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w
[3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-67326

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../python/python3-git/CVE-2026-67326.patch   | 109 ++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |   1 +
 2 files changed, 110 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch
new file mode 100644
index 0000000000..24d65e2448
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch
@@ -0,0 +1,109 @@
+From 54538428f79b0c91ba52cda5229856a6edf7ac06 Mon Sep 17 00:00:00 2001
+From: "GPT 5.5" <codex@openai.com>
+Date: Tue, 5 May 2026 21:34:42 +0800
+Subject: [PATCH] Validate config key section names before writing
+
+GitConfigParser already rejected CR, LF, and NUL in config values before
+writing, but section and option names could still reach configparser. Because
+GitPython writes section headers itself, a newline-bearing section name could
+split the output into additional headers.
+
+Reject CR, LF, and NUL in section and option names on write paths that create
+or set config keys: add_section(), set(), set_value(), add_value(), and
+rename_section() destinations. This matches Git config key validation behavior;
+Git source commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0 reports invalid keys
+containing newlines from config.c, and local git 2.50.1 rejects newline-bearing
+config keys.
+
+Add a regression test covering unsafe section and option names while preserving
+safe writes.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+
+Backport Changes:
+- Omitted test/test_config.py because the PyPI 3.1.43 source used
+  by the recipe does not ship the upstream test tree.
+
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06]
+CVE: CVE-2026-67326
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ git/config.py | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/git/config.py b/git/config.py
+index 1595d51..236de3a 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -72,6 +72,9 @@ CONDITIONAL_INCLUDE_REGEXP = re.compile(r"(?<=includeIf )\"(gitdir|gitdir/i|onbr
+ See: https://git-scm.com/docs/git-config#_conditional_includes
+ """
+ 
++UNSAFE_CONFIG_CHARS_RE = re.compile(r"[\r\n\x00]")
++"""Characters that cannot be safely written in config names or values."""
++
+ 
+ class MetaParserBuilder(abc.ABCMeta):  # noqa: B024
+     """Utility class wrapping base-class methods into decorators that assure read-only
+@@ -759,6 +762,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ 
+     def add_section(self, section: str) -> None:
+         """Assures added options will stay in order."""
++        self._assure_config_name_safe(section, "section")
+         return super().add_section(section)
+ 
+     @property
+@@ -865,10 +869,14 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+ 
+     def _value_to_string_safe(self, value: Union[str, bytes, int, float, bool]) -> str:
+         value_str = self._value_to_string(value)
+-        if re.search(r"[\r\n\x00]", value_str):
++        if UNSAFE_CONFIG_CHARS_RE.search(value_str):
+             raise ValueError("Git config values must not contain CR, LF, or NUL")
+         return value_str
+ 
++    def _assure_config_name_safe(self, name: "cp._SectionName", label: str) -> None:
++        if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):
++            raise ValueError("Git config %s names must not contain CR, LF, or NUL" % label)
++
+     @needs_values
+     @set_dirty_and_flush_changes
+     def set(
+@@ -877,6 +885,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+         option: str,
+         value: Union[str, bytes, int, float, bool, None] = None,
+     ) -> None:
++        self._assure_config_name_safe(section, "section")
++        self._assure_config_name_safe(option, "option")
+         if value is not None:
+             value = self._value_to_string_safe(value)
+         return super().set(section, option, value)
+@@ -901,6 +911,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+         :return:
+             This instance
+         """
++        self._assure_config_name_safe(section, "section")
++        self._assure_config_name_safe(option, "option")
+         value_str = self._value_to_string_safe(value)
+         if not self.has_section(section):
+             self.add_section(section)
+@@ -929,6 +941,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+         :return:
+             This instance
+         """
++        self._assure_config_name_safe(section, "section")
++        self._assure_config_name_safe(option, "option")
+         value_str = self._value_to_string_safe(value)
+         if not self.has_section(section):
+             self.add_section(section)
+@@ -949,6 +963,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+         """
+         if not self.has_section(section):
+             raise ValueError("Source section '%s' doesn't exist" % section)
++        self._assure_config_name_safe(new_name, "section")
+         if self.has_section(new_name):
+             raise ValueError("Destination section '%s' already exists" % new_name)
+ 
+-- 
+2.43.0
+
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index ebb5e4b442..474206d4ed 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -21,6 +21,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-44243_p2.patch \
            file://CVE-2026-44244_p1.patch \
            file://CVE-2026-44244_p2.patch \
+           file://CVE-2026-67326.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.43.0

Re: [OE-core][wrynose][patch] python3-git: Fix CVE-2026-67326

[Yoann Congal]

On Fri Oct 16, 2026 at 7:33 AM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> This patch applies the upstream fix as referenced in [2], using the
> commit shown in [1].
>
> [1] https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06
> [2] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w
> [3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-67326
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>  .../python/python3-git/CVE-2026-67326.patch   | 109 ++++++++++++++++++
>  .../python/python3-git_3.1.43.bb              |   1 +
>  2 files changed, 110 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch

Hello,

This is fixing the same CVE as a patch in a larger/later series:
https://lore.kernel.org/all/20261016054106.210444-2-yurade@cisco.com/

Vijay, can you review Yogita's patch? This would make my life easier.

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [OE-core][wrynose][patch] python3-git: Fix CVE-2026-67326

[Vijay Anusuri]

[-- Attachment #1: Type: text/plain, Size: 1429 bytes --]

Hi Yoann,

I reviewed the fix for CVE-2026-67326 and confirmed that it is identical to
the fix in the larger patch series.

I haven't reviewed the remaining patches in the series.

You can ignore my patch.


Thanks & Regards,
Vijay


On Fri, Oct 16, 2026 at 12:33 PM Yoann Congal <yoann.congal@smile.fr> wrote:

> On Fri Oct 16, 2026 at 7:33 AM CEST, Vijay Anusuri via
> lists.openembedded.org wrote:
> > This patch applies the upstream fix as referenced in [2], using the
> > commit shown in [1].
> >
> > [1]
> https://github.com/gitpython-developers/GitPython/commit/54538428f79b0c91ba52cda5229856a6edf7ac06
> > [2]
> https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w
> > [3] https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-67326
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
> >  .../python/python3-git/CVE-2026-67326.patch   | 109 ++++++++++++++++++
> >  .../python/python3-git_3.1.43.bb              |   1 +
> >  2 files changed, 110 insertions(+)
> >  create mode 100644
> meta/recipes-devtools/python/python3-git/CVE-2026-67326.patch
>
> Hello,
>
> This is fixing the same CVE as a patch in a larger/later series:
> https://lore.kernel.org/all/20261016054106.210444-2-yurade@cisco.com/
>
> Vijay, can you review Yogita's patch? This would make my life easier.
>
> Thanks!
> --
> Yoann Congal
> Smile ECS
>
>

[-- Attachment #2: Type: text/html, Size: 2666 bytes --]

Re: [OE-core][wrynose][patch] python3-git: Fix CVE-2026-67326

[Yoann Congal]

On Fri Oct 16, 2026 at 1:48 PM CEST, Vijay Anusuri wrote:
> Hi Yoann,
>
> I reviewed the fix for CVE-2026-67326 and confirmed that it is identical to
> the fix in the larger patch series.
>
> I haven't reviewed the remaining patches in the series.
>
> You can ignore my patch.

Thanks Vijay!

>
>
> Thanks & Regards,
> Vijay
-- 
Yoann Congal
Smile ECS