[OE-core][wrynose][v2 PATCH 04/27] python3-git: fix CVE-2026-67324

[Yogita Urade <yurade@cisco.com>]

Upstream commit [1] adds joined-short-option parsing, including
clustered forms such as -fuVALUE, while preserving safe attached
values. This behavior matches CVE-2026-67324's description [2] and
the upstream advisory [3]. The commit also adjusts clone-option
handling to preserve long-option abbreviation checks.

[1] https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-67324
[3] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
-  Refreshed patch context and removed trailing whitespace.
---
 .../python/python3-git/CVE-2026-67324.patch   | 94 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 95 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch
new file mode 100644
index 0000000000..73722344c1
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-67324.patch
@@ -0,0 +1,94 @@
+From b09720b6f8311edac108392bd834e74918836c4f Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Sun, 12 Jul 2026 14:12:16 +0200
+Subject: [PATCH] fix: reject joined unsafe short options
+
+GitPython blocks options such as --upload-pack/-u and --config/-c
+because they can execute arbitrary commands unless unsafe options are
+explicitly allowed. Git also accepts a short option with its value
+joined to the same token, including after clusterable flags. Forms
+such as -uVALUE, -fuVALUE, -cVALUE, and -vcVALUE could therefore
+bypass an exact-token check.
+
+Parse single-dash option tokens sufficiently to recognize blocked
+short options while preserving safe attached values such as
+-oupstream. Also distinguish clone multi-option values from bare
+kwargs so positional values are not treated as long-option
+abbreviations.
+
+This completes the option-validation hardening for
+GHSA-2f96-g7mh-g2hx.
+
+CVE: CVE-2026-67324
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285]
+
+Backport Changes:
+- Omitted test/test_clone.py, test/test_git.py, test/test_remote.py
+  because the current PyPI source archive does not include the test
+  suite and the python3-git recipe does not run it.
+
+Reviewed-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 56806080c1348749b07daa4a2024ce47b3cad285)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 40 ++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 523029fc..75495dc1 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -734,8 +734,21 @@
+     @classmethod
+     def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
+-        """Check for unsafe options.
+-
+-        Some options that are passed to ``git <command>`` can be used to execute
+-        arbitrary commands. These are blocked by default.
++        """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings.
++
++        In addition to exact matches, this rejects abbreviated long options accepted
++        by Git (for example, ``--upl`` for ``--upload-pack``) and unsafe short options
++        whose values are joined to the same token, including after clusterable flags
++        (for example, ``-uVALUE`` and ``-fuVALUE``).
++
++        A list containing only bare names is treated as normalized keyword arguments,
++        so multi-character names such as ``upload_p`` are checked as long-option
++        abbreviations. If any item starts with ``-``, the list is treated as tokenized
++        command-line input: bare items can be option values and are not checked as
++        abbreviations. Thus ``["--origin", "upload"]`` is allowed. Single-dash options
++        use short-option parsing rather than broad prefix matching, preserving safe
++        attached values such as ``-oupstream`` and ``-bcurrent``.
++
++        Some options passed to ``git <command>`` can execute arbitrary commands and
++        are therefore blocked by default unless the caller explicitly allows them.
+         """
+         # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
+@@ -747,4 +760,13 @@
+         # only.
+         canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
++        unsafe_short_options = {
++            canonical: option
++            for canonical, option in canonical_unsafe_options.items()
++            if option.startswith("-") and not option.startswith("--") and len(canonical) == 1
++        }
++        # These value-less Git flags can be clustered before another short option
++        # (for example, ``-fuVALUE``). Stop at any other character because it may
++        # begin an attached value, as ``o`` does in the safe option ``-oupstream``.
++        clusterable_short_options = frozenset("46flnqsv")
+         options_are_kwargs = all(not option.startswith("-") for option in options)
+         for option in options:
+@@ -757,3 +779,13 @@
+                 raise UnsafeOptionError(f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it.")
++            option_token = option.split("=", 1)[0].split(None, 1)[0]
++            if option_token.startswith("-") and not option_token.startswith("--"):
++                for option_char in option_token[1:]:
++                    unsafe_option = unsafe_short_options.get(option_char)
++                    if unsafe_option is not None:
++                        raise UnsafeOptionError(
++                            f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
++                        )
++                    if option_char not in clusterable_short_options:
++                        break
+             if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)):
+                 continue
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 76a21c670f..ca2efce37e 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -25,6 +25,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-67323.patch \
            file://CVE-2026-67325_p1.patch \
            file://CVE-2026-67325_p2.patch \
+           file://CVE-2026-67324.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0