-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 20:04:49 -0300 Source: python-git Architecture: source Version: 3.1.30-1+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Emmanuel Arias <eamanu@debian.org> Closes: 1135349 1135350 1143454 1143602 1144344 1144929 Changes: python-git (3.1.30-1+deb12u3) bookworm-security; urgency=high . * CVE-2026-42215: block unsafe options passed as underscored kwargs (Closes: #1135349). * CVE-2026-42284: check unsafe options after splitting multi_options with shlex (Closes: #1135350). * CVE-2026-44243: prevent access to files outside the repository when manipulating references. * CVE-2026-44244: reject control characters in config values written by the config writer, preventing config injection. * CVE-2026-67322: do not expand environment variables in clone URLs, which could leak secrets to a remote host (Closes: #1143454). * CVE-2026-67323: guard unsafe options (--exec, --upload-pack, ...) in archive, fetch, pull, push, ls-remote, blame and revision APIs. * CVE-2026-67324, CVE-2026-67325: abbreviated long options and joined short options bypassed the unsafe option checks, leading to command execution. * CVE-2026-67326: config section names were not validated before writing, allowing config injection. * CVE-2026-69097: config section names containing an unquoted closing bracket could inject arbitrary settings into .git/config (Closes: #1143602). * CVE-2026-73619: add --add-file, --add-virtual-file (archive) and --bundle-uri (clone) to the unsafe option lists (Closes: #1144344). * CVE-2026-73620: block unsafe options in IndexFile.checkout() (--prefix) and TagReference.create() (-F/--file), which could write to or read from arbitrary filesystem paths. * CVE-2026-73621: reject unsafe output options in Commit.count. * CVE-2026-73622: do not expand environment variables in remote and submodule URLs, which could leak secrets to a remote host. * CVE-2026-73623: reject unsafe --template option when cloning. * CVE-2026-73624: guard unsafe output options in diff operations. * CVE-2026-73625: validate the values of split short options, which could bypass the unsafe option checks in clone, remote, revision, blame and archive operations. * CVE-2026-76217: guard --pathspec-from-file options in IndexFile.remove, Head.checkout and HEAD.reset (Closes: #1144929). * CVE-2026-76218: guard unsafe git init options (--template, --separate-git-dir) in Repo.init. * CVE-2026-76219: guard --index-output in read-tree calls made by from_tree, merge_tree and reset, which could write to an arbitrary path. * CVE-2026-76220: check the value joined to one-character options when split_single_char_options is false, which could bypass the unsafe option checks. * CVE-2026-76221: reject config option names containing characters that could inject arbitrary settings when writing the config. * CVE-2026-76222: validate submodule names read from .gitmodules before filesystem operations, preventing path traversal outside the repository. * CVE-2026-78675: do not process include directives in .gitmodules, which could read arbitrary files. * CVE-2026-78676: preserve multiline config values when writing, which could otherwise inject new options into the config. * CVE-2026-78677: block --separate-git-dir in Repo.clone() and Repo.clone_from(), which could write repository metadata to an arbitrary path. * CVE-2026-78678, CVE-2026-78679: block file-reading options in blame, diff and tag APIs, which could read arbitrary files. * CVE-2026-87817: prefer the .git entry during repository discovery and validate candidate git directories, aligning the behaviour with git. * CVE-2026-87818: treat --no-index as an unsafe diff option, since it allows diffing arbitrary filesystem paths. * CVE-2026-87819: parse actor identities without regular expressions, avoiding quadratic backtracking (ReDoS) on malformed identities. * CVE-2026-100689: reject submodule checkout paths that resolve outside the repository or through a symbolic link, applying to Submodule.update the containment check already used by add and move. * CVE-2026-110855: do not expand environment variables in the separate_git_dir path when cloning, preserving literal paths so repository metadata is not written to an unexpected location * CVE-2026-110856: parse actor identities and dates in commit authors, committers and taggers without backtracking regular expressions, avoiding excessive CPU use (ReDoS) on malformed metadata. * CVE-2026-110857: complete the unsafe option and protocol checks in Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which previously omitted guards already used by sibling APIs. * CVE-2026-110858: reject option-shaped remote names in Remote.update(), which git forwards to "fetch --multiple" without an option terminator, allowing a leading-dash name to change the requested operation. * CVE-2026-110859: validate the positional reference passed by Head.checkout() against the unsafe-option policy, since reference names originating in a cloned repository could otherwise bypass it. * CVE-2026-110860: reject submodule checkout, move and metadata paths that traverse intermediate symbolic links before performing filesystem operations. * CVE-2026-114145: GitPython validates a submodule's '.git' path only after cloning into it (RCE). Checksums-Sha1: 74e553a38004afe2eb75816403ba82dc4b593ddc 2801 python-git_3.1.30-1+deb12u3.dsc 182e33029e675dc700d90006c6508e31a2579b10 477652 python-git_3.1.30.orig.tar.gz e788ad4790100f972b9f6c0357ae410e86768574 72312 python-git_3.1.30-1+deb12u3.debian.tar.xz 636ac6f70b1fb252afc68057859e9f10ac00edf7 8524 python-git_3.1.30-1+deb12u3_source.buildinfo Checksums-Sha256: 9c059c8628330c3cf988e7966f2140cd615d66c559c8207feefdbc7e8cabd0c8 2801 python-git_3.1.30-1+deb12u3.dsc faa4b66b0b75f172358fbb75243c9d2a70b26623232eef365739fc96e9ecffc8 477652 python-git_3.1.30.orig.tar.gz 6c42b7af995dd31eb177094a104f22180a65725bc3e53956a11b4176f9d94a52 72312 python-git_3.1.30-1+deb12u3.debian.tar.xz 3ac19638ef4f58a9b0c08e320a3677d2f45c90bcced8e2d2bf6fba6b0202748d 8524 python-git_3.1.30-1+deb12u3_source.buildinfo Files: 6b3c750e83d4e523fdc9516d2b5ccb2b 2801 python optional python-git_3.1.30-1+deb12u3.dsc 50bee4876f7e4ac3a67111c0aa602d0d 477652 python optional python-git_3.1.30.orig.tar.gz 27cabd9b9b5c1d31d2742c4ab23035e6 72312 python optional python-git_3.1.30-1+deb12u3.debian.tar.xz 4e6de48ef5fc7ee86d0104754785b4e8 8524 python optional python-git_3.1.30-1+deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmrl2gISHGVhbWFudUBk ZWJpYW4ub3JnAAoJEPqd7F3hHGPxAo4P/3AQb9U1HAZ2xinoqTZTxPcRu5bMDTpn 8GxnUtVttjhY1rUOR+Dliev9M7pAzkGt9XoDNQqrc9/gtdcBgxzMABMTdoA6OvRu DhfMbrnBnFxvrEfKjQDX4dpJYfLmmFPz5ivAiRaAwDsEn/pDEN+H3ms457Pj2kT0 LblM32sfdDs5dZizR7q9uQECuglIggcEterpRyAfhwm3MHP2bRzfznX38q+ZzzlE cs0W5ZnrY+CQirzzR6AR9PDXhKTuwsYLhdMVrztj77GbH1NnhhM4VwXkWM5JJPGq h8Kfb6vMC/nmnoTW6vy+I5rbOgLXxP2xxMnFMNzDW4qDND0lE8F+8UaxKqmtEevP F5o1alZTiVqwejBQrvBO0r7KxVsF4nB2guMRe8EtwFxz+Vu8O+X/s+3Yry0rNAY5 pJkp8QnDMAY/ARtUmZkMoBy/cKSlHJhq/rNALESXCXIikbkQgEFgdBUuJFtoBfqC VhbGiIjuqER0vB2Mba6Kse3czrg3yeK76xk2QZe0kch33eNg+w2wNkmajp3aSPLH zXajh1AIKyMDnQz13TpEJ1WkMRSSwCQrgUE0nzEguV8P50K0PPiAG9e/RvXku7dz JSJUYR/lxdnsYOzKp088UowcyC4lXVrjQYFGCHcYwrr4aeZZXaZFUi/5CDmTQlVa mMBdohZ54LIc =go6U -----END PGP SIGNATURE-----
