On Wed Aug 19, 2026 at 7:08 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: > From: Darsh Kelaiya <[email protected]> > > This patch applies the upstream fix as referenced in [4], using all the > backported commits shown in [1], [2], and [3]. > > [1] > https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6 > [2] > https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826 > [3] > https://github.com/gitpython-developers/GitPython/commit/43d92dec4683568d11495956dd556161f17c3ea8 > [4] > https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 > > Signed-off-by: Darsh Kelaiya <[email protected]> > --- > .../python3-git/CVE-2026-42215_p1.patch | 60 +++++++++++++++++++ > .../python3-git/CVE-2026-42215_p2.patch | 29 +++++++++ > .../python3-git/CVE-2026-42215_p3.patch | 45 ++++++++++++++ > .../python/python3-git_3.1.43.bb | 3 + > 4 files changed, 137 insertions(+) > create mode 100644 > meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch > create mode 100644 > meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch > create mode 100644 > meta/recipes-devtools/python/python3-git/CVE-2026-42215_p3.patch > > diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch > b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch > new file mode 100644 > index 0000000000..0129250fdf > --- /dev/null > +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p1.patch > @@ -0,0 +1,60 @@ > +From dd5d1c4ddcc5d44faf4e71bcfa338f09db2022d6 Mon Sep 17 00:00:00 2001 > +From: w <[email protected]> > +Date: Mon, 20 Apr 2026 23:29:50 -0400 > +Subject: [PATCH] Block unsafe underscored git kwargs / Fix for > + GHSA-rpm5-65cw-6hj4 > + > +CVE: CVE-2026-42215 > +Upstream-Status: Backport > [https://github.com/gitpython-developers/GitPython/commit/142195888e713542189533a52cdfc333f05c3af6] > + > +Backport Changes: > +- Omitted test/test_clone.py, test/test_git.py, and > + test/test_remote.py because the PyPI 3.1.43 source used by the > + recipe does not ship the upstream test tree. > + > +(cherry picked from commit 142195888e713542189533a52cdfc333f05c3af6) > +Signed-off-by: Darsh Kelaiya <[email protected]> > +--- > + git/cmd.py | 21 +++++++++++++-------- > + 1 file changed, 13 insertions(+), 8 deletions(-) > + > [...] > diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch > b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch > new file mode 100644 > index 0000000000..4326bede07 > --- /dev/null > +++ b/meta/recipes-devtools/python/python3-git/CVE-2026-42215_p2.patch > @@ -0,0 +1,29 @@ > +From e77461e6953a67f17ecd1808c352e6613a17345b Mon Sep 17 00:00:00 2001 > +From: w <[email protected]> > +Date: Mon, 20 Apr 2026 23:43:59 -0400 > +Subject: [PATCH] linter fix > + > +CVE: CVE-2026-42215 > +Upstream-Status: Backport > [https://github.com/gitpython-developers/GitPython/commit/9aed7cf8c20f69effcfcf7ebef09f312f73ab826] > + > +(cherry picked from commit 9aed7cf8c20f69effcfcf7ebef09f312f73ab826) > +Signed-off-by: Darsh Kelaiya <[email protected]> > +--- > + git/cmd.py | 4 +--- > + 1 file changed, 1 insertion(+), 3 deletions(-) > + > +diff --git a/git/cmd.py b/git/cmd.py > +index 2ecb8e66..372eac28 100644 > +--- a/git/cmd.py > ++++ b/git/cmd.py > +@@ -729,9 +729,7 @@ class Git(metaclass=_GitMeta): > + for option in options: > + unsafe_option = > canonical_unsafe_options.get(cls._canonicalize_option_name(option)) > + if unsafe_option is not None: > +- raise UnsafeOptionError( > +- f"{unsafe_option} is not allowed, use > `allow_unsafe_options=True` to allow it." > +- ) > ++ raise UnsafeOptionError(f"{unsafe_option} is not allowed, > use `allow_unsafe_options=True` to allow it.") > + > + class AutoInterrupt: > + """Process wrapper that terminates the wrapped process on > finalization.
Hello, I don't think we need this "linter fix" _p2 patch. If that works, can you send a v2 without it? Same for the scarthgap patch. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244946): https://lists.openembedded.org/g/openembedded-core/message/244946 Mute This Topic: https://lists.openembedded.org/mt/120825621/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
