Re: [OE-core][wrynose][PATCH 06/27] python3-git: fix CVE-2026-69097

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Oct 16, 2026 at 7:40 AM CEST, Yogita Urade -X (yurade - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> [1] https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-69097
>
> Signed-off-by: Yogita Urade <yurade@cisco.com>
> ---
>  .../python/python3-git/CVE-2026-69097.patch   | 48 +++++++++++++++++++
>  .../python/python3-git_3.1.43.bb              |  1 +
>  2 files changed, 49 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
>
> diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
> new file mode 100644
> index 0000000000..fc22c65818
> --- /dev/null
> +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-69097.patch
> @@ -0,0 +1,48 @@
> +From 00034e1e5eb542542158461c3c542d3bfd3a49f0 Mon Sep 17 00:00:00 2001
> +From: Yogita Urade <yurade@cisco.com>
> +Date: Fri, 25 Sep 2026 03:55:16 -0700
> +Subject: [PATCH] Validate config section delimiters
> +
> +Reject unsafe unquoted closing brackets and malformed quoted subsections.
> +
> +CVE: CVE-2026-69097
> +Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f]
> +
> +Backport Changes:
> +- Omitted test/test_config.py because the current PyPI 
> +  source archive does not include the test suite and 
> +  the python3-git recipe does not run it.
> +
> +(cherry picked from commit 1ed1b924f4e2d2ee7bab296df77b978af21853f)
> +Signed-off-by: Yogita Urade <yurade@cisco.com>

Hello,

Please keep the upstream patch metadata (authorship, commit message,
...)
This might be a corner case where the upstream author is
"GPT 5.6" <codex@openai.com>, but still...

Regards,
-- 
Yoann Congal
Smile ECS