mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-15 04:57:15 +00:00
Code Issues Projects Releases Wiki Activity

python3-git: fix CVE-2026-42215

Browse Source 
This patch applies the upstream 3.1.47 backport for
CVE-2026-42215. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commits are referenced in [3] and [4].

[1] https://github.com/gitpython-developers/GitPython/commit/0f68db0710f9125762fca5dbc2328593537ae923
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-42215
[3] https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6
[4] https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8

(From OE-Core rev: d1c3217c9cc503d85d4fd796d424c43496255ba7)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Darsh Kelaiya authored and Paul Barker committed 2026-09-28 10:17:43 +01:00
1 parent 3c0b7e86d1
commit ff174ac8fd
3 files changed
+110
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch
+61
View File
@@ -0,0 +1,61 @@
From 341a49149a37762e12b10eb70605b54f4abfb54d Mon Sep 17 00:00:00 2001
From: w <w@mac.lan>
Date: Mon, 20 Apr 2026 23:29:50 -0400
Subject: [PATCH] Block unsafe underscored git kwargs / Fix for
GHSA-rpm5-65cw-6hj4
CVE: CVE-2026-42215
Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6]
Backport Changes:
- Omit regression tests because the Scarthgap PyPI source
archive does not include the upstream test suite.
(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
git/cmd.py | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/git/cmd.py b/git/cmd.py
index f58e6df5..874acb43 100644
--- a/git/cmd.py
+++ b/git/cmd.py
@@ -540,6 +540,12 @@ class Git(LazyMixin):
f"The `{protocol}::` protocol looks suspicious, use `allow_unsafe_protocols=True` to allow it."
)
+ @classmethod
+ def _canonicalize_option_name(cls, option: str) -> str:
+ """Normalize an option or kwarg name for unsafe-option checks."""
+ option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
+ return dashify(option_name)
+
@classmethod
def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
"""Check for unsafe options.
@@ -547,15 +553,14 @@ class Git(LazyMixin):
Some options that are passed to `git <command>` can be used to execute
arbitrary commands, this are blocked by default.
"""
- # Options can be of the form `foo` or `--foo bar` `--foo=bar`,
- # so we need to check if they start with "--foo" or if they are equal to "foo".
- bare_unsafe_options = [option.lstrip("-") for option in unsafe_options]
+ # Options can be of the form `foo`, `--foo`, `--foo bar`, or `--foo=bar`.
+ canonical_unsafe_options = {cls._canonicalize_option_name(option): option for option in unsafe_options}
for option in options:
- for unsafe_option, bare_option in zip(unsafe_options, bare_unsafe_options):
- if option.startswith(unsafe_option) or option == bare_option:
- raise UnsafeOptionError(
- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
- )
+ unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))
+ if unsafe_option is not None:
+ raise UnsafeOptionError(
+ f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+ )
class AutoInterrupt:
"""Process wrapper that terminates the wrapped process on finalization.
--
2.35.6
meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch
+47
View File
@@ -0,0 +1,47 @@
From 3385ff27397b58288d922838e8d2eae87d7534fd Mon Sep 17 00:00:00 2001
From: w <w@mac.lan>
Date: Tue, 21 Apr 2026 12:03:20 -0400
Subject: [PATCH] git.cmd: harden unsafe option canonicalization and isolate
push test cases
CVE: CVE-2026-42215
Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8]
Backport Changes:
- Omit regression test updates because the Scarthgap PyPI
source archive does not include the upstream test suite.
(cherry picked from commit 43d92dec4683568d11495956dd556161f17c3ea8)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
git/cmd.py | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/git/cmd.py b/git/cmd.py
index 69756216..73b4c052 100644
--- a/git/cmd.py
+++ b/git/cmd.py
@@ -542,9 +542,18 @@ class Git(LazyMixin):
@classmethod
def _canonicalize_option_name(cls, option: str) -> str:
- """Normalize an option or kwarg name for unsafe-option checks."""
- option_name = option.lstrip("-").split("=", 1)[0].split(None, 1)[0]
- return dashify(option_name)
+ """Return the option name used for unsafe-option checks.
+
+ Examples:
+ ``"--upload-pack=/tmp/helper"`` -> ``"upload-pack"``
+ ``"upload_pack"`` -> ``"upload-pack"``
+ ``"--config core.filemode=false"`` -> ``"config"``
+ """
+ option_name = option.lstrip("-").split("=", 1)[0]
+ option_tokens = option_name.split(None, 1)
+ if not option_tokens:
+ return ""
+ return dashify(option_tokens[0])
@classmethod
def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
--
2.35.6
meta/recipes-devtools/python/python3-git_3.1.42.bb
+2
View File
@@ -19,6 +19,8 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-44243_p2.patch \
file://CVE-2026-44244_p1.patch \
file://CVE-2026-44244_p2.patch \
file://CVE-2026-42215_p1.patch \
file://CVE-2026-42215_p2.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"