[OE-core][wrynose][v2 PATCH 08/27] python3-git: fix CVE-2026-73623

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97
[2] https://security-tracker.debian.org/tracker/CVE-2026-73623

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
  Updated the Backport Changes line wrapping and hunk context.
---
 .../python/python3-git/CVE-2026-73623.patch   | 53 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch
new file mode 100644
index 0000000000..7cb48e1511
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73623.patch
@@ -0,0 +1,53 @@
+From 3621c3099fef859e91f9f960707902018a370978 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Wed, 22 Jul 2026 04:43:26 +0200
+Subject: [PATCH] fix: reject unsafe clone templates
+
+<!-- agent -->
+
+Treat git clone --template as unsafe because caller-controlled
+templates can install hooks that execute during clone.
+
+Add regression coverage for both direct option and keyword forms.
+
+References GHSA-6p8h-3wgx-97gf.
+Validated against Git baseline a23bace9.
+
+CVE: CVE-2026-73623
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97]
+
+Backport Changes:
+- Omitted test/test_clone.py because the current PyPI
+  source archive does not include the test suite and
+  the python3-git recipe does not run it.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/repo/base.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/git/repo/base.py b/git/repo/base.py
+index d661f036..2776c19e 100644
+--- a/git/repo/base.py
++++ b/git/repo/base.py
+@@ -148,6 +148,8 @@ Repo.unsafe_git_clone_options
+         # Can override configuration variables that execute arbitrary commands:
+         "--config",
+         "-c",
++        # Can install hooks that execute during clone:
++        "--template",
+     ]
+     """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed.
+ 
+@@ -158,6 +160,9 @@ Repo.unsafe_git_clone_options
+     The ``--config``/``-c`` option allows users to override configuration variables like
+     ``protocol.allow`` and ``core.gitProxy`` to execute arbitrary commands:
+     https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---configltkeygtltvaluegt
++
++    The ``--template`` option can install hooks that execute during clone:
++    https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory
+     """
+     unsafe_git_archive_options = [
+         # Allows arbitrary command execution through the remote git-upload-archive command.
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 551b47fc39..d996d4f9f5 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -29,6 +29,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-67322.patch \
            file://CVE-2026-69097.patch \
            file://CVE-2026-73625.patch \
+           file://CVE-2026-73623.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0