mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-29 11:50:13 +00:00
Code Issues Projects Releases Wiki Activity

python3-git: fix CVE-2026-44244

Browse Source 
This patch applies the upstream 3.1.49 backport for
CVE-2026-44244. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commits are referenced in [3] and [4].

[1] https://github.com/gitpython-developers/GitPython/commit/b049a13105992f22376ad0c7ec945bf3bfb365ae
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44244
[3] https://github.com/gitpython-developers/GitPython/commit/c417af469f9aa3da8dfef78f996c0fb8c5d1f4c2
[4] https://github.com/gitpython-developers/GitPython/commit/8e24503b42c1d63dd98e8b2e6a2f655bdd0821e3

(From OE-Core rev: 9aaa23d4f6c04049fcdb532f6a83c654e8e6e15d)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Darsh Kelaiya
2026-09-11 14:32:08 +01:00
committed by Richard Purdie
parent 96afd71237
commit 7be1953871
3 changed files with 136 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/python/python3-git/CVE-2026-44244_p2.patch
+30
View File
@@ -0,0 +1,30 @@
From cf273ba3958ad02afa361167a0d0f82e1f4b5f4d Mon Sep 17 00:00:00 2001
From: "GPT 5.5" <codex@openai.com>
Date: Wed, 29 Apr 2026 06:39:02 +0800
Subject: [PATCH] avoid duplicate validation in set_value
CVE: CVE-2026-44244
Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/8e24503b42c1d63dd98e8b2e6a2f655bdd0821e3]
Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
(cherry picked from commit 8e24503b42c1d63dd98e8b2e6a2f655bdd0821e3)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
git/config.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/git/config.py b/git/config.py
index ce307110..7988f5d9 100644
--- a/git/config.py
+++ b/git/config.py
@@ -876,7 +876,7 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
value_str = self._value_to_string_safe(value)
if not self.has_section(section):
self.add_section(section)
- self.set(section, option, value_str)
+ super().set(section, option, value_str)
return self
@needs_values
--
2.35.6