[OE-core][wrynose][v2 PATCH 03/27] python3-git: Fix CVE-2026-67325

[Yogita Urade <yurade@cisco.com>]

CVE-2026-67325 concerns bypasses using abbreviated long options.
Commit [1] introduces rejection of those abbreviations, and [2]
refines that check. The CVE description is in [3].

[1] https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f
[2] https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-67325

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Kept p1's UnsafeOptionError raise in upstream's multi-line form.
- Formatted p2's exact-match UnsafeOptionError raise on one line to match
  upstream.
---
 .../python3-git/CVE-2026-67325_p1.patch       | 49 +++++++++++++++++
 .../python3-git/CVE-2026-67325_p2.patch       | 52 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  2 +
 3 files changed, 103 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch
new file mode 100644
index 0000000000..4c1f3195d9
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p1.patch
@@ -0,0 +1,49 @@
+From 048f65847761514ebccf3cd8a889fef7a0068c07 Mon Sep 17 00:00:00 2001
+From: abhiprd2000 <8292aniarc@gmail.com>
+Date: Thu, 9 Jul 2026 21:22:50 +0530
+Subject: [PATCH] Reject abbreviated forms of unsafe git options
+
+CVE: CVE-2026-67325
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/2ab051697940144545a14d2f4a639c6409c3187f]
+
+Backport Changes:
+- Omitted test/test_clone.py because the current PyPI source
+  archive does not include the test suite and the python3-git
+  recipe does not run it.
+
+(cherry picked from commit 2ab051697940144545a14d2f4a639c6409c3187f)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 87866be2..f8fead70 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -739,13 +739,20 @@ Git.check_unsafe_options
+         arbitrary commands. These are blocked by default.
+         """
+         # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
++        # Git accepts any unambiguous prefix of a long option, so an abbreviated
++        # spelling such as `--upl` for `--upload-pack` must be rejected too. An
++        # option is unsafe if its canonical name is a prefix of any blocked
++        # option's canonical name.
+         canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
+         for option in options:
+-            unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+-            if unsafe_option is not None:
+-                raise UnsafeOptionError(
+-                    f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+-                )
++            candidate = cls._canonicalize_option_name(option)
++            if not candidate:
++                continue
++            for canonical, unsafe_option in canonical_unsafe_options.items():
++                if canonical.startswith(candidate):
++                    raise UnsafeOptionError(
++                        f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
++                    )
+ 
+     @classmethod
+     def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -> List[str]:
diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch
new file mode 100644
index 0000000000..65a914f0a0
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67325_p2.patch
@@ -0,0 +1,52 @@
+From 6de6760007664e5e9178b98e616d0b9edc959a53 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Sun, 12 Jul 2026 13:45:42 +0200
+Subject: [PATCH] Address review feedback about unsafe option abbreviations
+
+The prefix check could reject otherwise allowed one-letter short options when an unrelated blocked long option began with the same character. Keep exact matches for every spelling, but restrict prefix matching to explicit long options and multi-character kwargs.
+
+This addresses the review comment: single-letter short options and kwargs must not be treated as long-option abbreviations. It also adds coverage for abbreviated unsafe kwargs so both clone validation paths remain protected.
+
+CVE: CVE-2026-67325
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/181e8ede7543dbbdcee92756cea260f675316c63]
+
+Backport Changes:
+- Omitted test/test_clone.py, test/test_git.py because the current
+  PyPI source archive does not include the test suite and the
+  python3-git recipe does not run it.
+
+Reviewd-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 181e8ede7543dbbdcee92756cea260f675316c63)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index cd22aa83..3b97871e 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -742,14 +742,22 @@ Git.check_unsafe_options
+         # Git accepts any unambiguous prefix of a long option, so an abbreviated
+         # spelling such as `--upl` for `--upload-pack` must be rejected too. An
+         # option is unsafe if its canonical name is a prefix of any blocked
+-        # option's canonical name.
++        # option's canonical name. Only long options and multi-character kwargs
++        # can be abbreviations; single-character short options remain exact-match
++        # only.
+         canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
++        options_are_kwargs = all(not option.startswith("-") for option in options)
+         for option in options:
+             candidate = cls._canonicalize_option_name(option)
+             if not candidate:
+                 continue
++            unsafe_option = canonical_unsafe_options.get(candidate)
++            if unsafe_option is not None:
++                raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
++            if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)):
++                continue
+             for canonical, unsafe_option in canonical_unsafe_options.items():
+                 if canonical.startswith(candidate):
+                     raise UnsafeOptionError(
+                         f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+                     )
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 72eb073196..76a21c670f 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -23,6 +23,8 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-44244_p2.patch \
            file://CVE-2026-67326.patch \
            file://CVE-2026-67323.patch \
+           file://CVE-2026-67325_p1.patch \
+           file://CVE-2026-67325_p2.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0