On Wed, Sep 2, 2026 at 06:31 PM, Yoann Congal wrote: > > On Wed Aug 19, 2026 at 7:08 AM CEST, Darsh Kelaiya -X (dkelaiya - E > INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > >> From: Darsh Kelaiya <[email protected]> >> >> This patch applies the upstream fix as referenced in [4], using all the >> backported commits shown in [1], [2], and [3]. >> >> [1] >> https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6 >> >> [2] >> https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826 >> >> [3] >> https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8 >> >> [4] >> https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 >> >> >> Signed-off-by: Darsh Kelaiya <[email protected]> >> --- >> .../python3-git/CVE-2026-42215_p1.patch | 60 +++++++++++++++++++ >> .../python3-git/CVE-2026-42215_p2.patch | 29 +++++++++ >> .../python3-git/CVE-2026-42215_p3.patch | 45 ++++++++++++++ >> .../python/python3-git_3.1.43.bb | 3 + >> 4 files changed, 137 insertions(+) >> create mode 100644 >> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch >> create mode 100644 >> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch >> create mode 100644 >> meta/recipes-devtools/python/python3-git/CVE-2026-42215_p3.patch >> >> diff --git >> a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch >> b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch >> new file mode 100644 >> index 0000000000..0129250fdf >> --- /dev/null >> +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch >> @@ -0,0 +1,60 @@ >> +From dd5d1c4ddcc5d44faf4e71bcfa338f09db2022d6 Mon Sep 17 00:00:00 2001 >> +From: w <[email protected]> >> +Date: Mon, 20 Apr 2026 23:29:50 -0400 >> +Subject: [PATCH] Block unsafe underscored git kwargs / Fix for >> + GHSA-rpm5-65cw-6hj4 >> + >> +CVE: CVE-2026-42215 >> +Upstream-Status: Backport [ >> https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6 >> ] >> + >> +Backport Changes: >> +- Omitted test/test_clone.py, test/test_git.py, and >> + test/test_remote.py because the PyPI 3.1.43 source used by the >> + recipe does not ship the upstream test tree. >> + >> +(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6) >> +Signed-off-by: Darsh Kelaiya <[email protected]> >> +--- >> + git/cmd.py | 21 +++++++++++++-------- >> + 1 file changed, 13 insertions(+), 8 deletions(-) >> + >> [...] >> diff --git >> a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch >> b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch >> new file mode 100644 >> index 0000000000..4326bede07 >> --- /dev/null >> +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch >> @@ -0,0 +1,29 @@ >> +From e77461e6953a67f17ecd1808c352e6613a17345b Mon Sep 17 00:00:00 2001 >> +From: w <[email protected]> >> +Date: Mon, 20 Apr 2026 23:43:59 -0400 >> +Subject: [PATCH] linter fix >> + >> +CVE: CVE-2026-42215 >> +Upstream-Status: Backport [ >> https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826 >> ] >> + >> +(cherry picked from commit 9aed7cf8c20f69effcfcf7ebef09f312f73ab826) >> +Signed-off-by: Darsh Kelaiya <[email protected]> >> +--- >> + git/cmd.py | 4 +--- >> + 1 file changed, 1 insertion(+), 3 deletions(-) >> + >> +diff --git a/git/cmd.py b/git/cmd.py >> +index 2ecb8e66..372eac28 100644 >> +--- a/git/cmd.py >> ++++ b/git/cmd.py >> +@@ -729,9 +729,7 @@ class Git(metaclass=_GitMeta): >> + for option in options: >> + unsafe_option = >> canonical_unsafe_options.get(cls._canonicalize_option_name(option)) >> + if unsafe_option is not None: >> +- raise UnsafeOptionError( >> +- f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to >> allow it." >> +- ) >> ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, use >> `allow_unsafe_options=True` to allow it.") >> + >> + class AutoInterrupt: >> + """Process wrapper that terminates the wrapped process on finalization. > > Hello, > > I don't think we need this "linter fix" _p2 patch. If that works, can you > send a v2 without it? > > Same for the scarthgap patch. > > Thanks! > -- > Yoann Congal > Smile ECS
Hi Yoann, Thanks for the review. I've sent v2 patches for Wrynose [1] and Scarthgap [2] as requested. [1] https://lists.openembedded.org/g/openembedded-core/topic/wrynose_patch_v2_2_4/121083416 [2] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_2_4/121083408 Regards, Darsh Kelaiya
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245086): https://lists.openembedded.org/g/openembedded-core/message/245086 Mute This Topic: https://lists.openembedded.org/mt/120825621/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
