-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 28 Oct 2026 08:40:08 -0300 Source: python-git Architecture: source Version: 3.1.44-1+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: Debian Python Team Changed-By: Emmanuel Arias Closes: 1135349 1135350 1143454 1143602 1144344 1144929 Changes: python-git (3.1.44-1+deb13u1) trixie-security; urgency=medium . * CVE-2026-42215: block unsafe options passed as underscored kwargs (Closes: #1135349). * CVE-2026-42284: check unsafe options after splitting multi_options with shlex (Closes: #1135350). * CVE-2026-44243: prevent access to files outside the repository when manipulating references. * CVE-2026-44244: reject control characters in config values written by the config writer, preventing config injection. * CVE-2026-67322: do not expand environment variables in clone URLs, which could leak secrets to a remote host (Closes: #1143454). * CVE-2026-67323: guard unsafe options (--exec, --upload-pack, ...) in archive, fetch, pull, push, ls-remote, blame and revision APIs. * CVE-2026-67324, CVE-2026-67325: abbreviated long options and joined short options bypassed the unsafe option checks, leading to command execution. * CVE-2026-67326: config section names were not validated before writing, allowing config injection. * CVE-2026-69097: config section names containing an unquoted closing bracket could inject arbitrary settings into .git/config (Closes: #1143602). * CVE-2026-73619: add --add-file, --add-virtual-file (archive) and --bundle-uri (clone) to the unsafe option lists (Closes: #1144344). * CVE-2026-73620: block unsafe options in IndexFile.checkout() (--prefix) and TagReference.create() (-F/--file), which could write to or read from arbitrary filesystem paths. * CVE-2026-73621: reject unsafe output options in Commit.count. * CVE-2026-73622: do not expand environment variables in remote and submodule URLs, which could leak secrets to a remote host. * CVE-2026-73623: reject unsafe --template option when cloning. * CVE-2026-73624: guard unsafe output options in diff operations. * CVE-2026-73625: validate the values of split short options, which could bypass the unsafe option checks in clone, remote, revision, blame and archive operations. * CVE-2026-76217: guard --pathspec-from-file options in IndexFile.remove, Head.checkout and HEAD.reset (Closes: #1144929). * CVE-2026-76218: guard unsafe git init options (--template, --separate-git-dir) in Repo.init. * CVE-2026-76219: guard --index-output in read-tree calls made by from_tree, merge_tree and reset, which could write to an arbitrary path. * CVE-2026-76220: check the value joined to one-character options when split_single_char_options is false, which could bypass the unsafe option checks. * CVE-2026-76221: reject config option names containing characters that could inject arbitrary settings when writing the config. * CVE-2026-76222: validate submodule names read from .gitmodules before filesystem operations, preventing path traversal outside the repository. * CVE-2026-78675: do not process include directives in .gitmodules, which could read arbitrary files. * CVE-2026-78676: preserve multiline config values when writing, which could otherwise inject new options into the config. * CVE-2026-78677: block --separate-git-dir in Repo.clone() and Repo.clone_from(), which could write repository metadata to an arbitrary path. * CVE-2026-78678, CVE-2026-78679: block file-reading options in blame, diff and tag APIs, which could read arbitrary files. * CVE-2026-87817: prefer the .git entry during repository discovery and validate candidate git directories, aligning the behaviour with git. * CVE-2026-87818: treat --no-index as an unsafe diff option, since it allows diffing arbitrary filesystem paths. * CVE-2026-87819: parse actor identities without regular expressions, avoiding quadratic backtracking (ReDoS) on malformed identities. * CVE-2026-100689: reject submodule checkout paths that resolve outside the repository or through a symbolic link, applying to Submodule.update the containment check already used by add and move. * CVE-2026-110855: do not expand environment variables in the separate_git_dir path when cloning, preserving literal paths so repository metadata is not written to an unexpected location * CVE-2026-110856: parse actor identities and dates in commit authors, committers and taggers without backtracking regular expressions, avoiding excessive CPU use (ReDoS) on malformed metadata. * CVE-2026-110857: complete the unsafe option and protocol checks in Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which previously omitted guards already used by sibling APIs. * CVE-2026-110858: reject option-shaped remote names in Remote.update(), which git forwards to "fetch --multiple" without an option terminator, allowing a leading-dash name to change the requested operation. * CVE-2026-110859: validate the positional reference passed by Head.checkout() against the unsafe-option policy, since reference names originating in a cloned repository could otherwise bypass it. * CVE-2026-110860: reject submodule checkout, move and metadata paths that traverse intermediate symbolic links before performing filesystem operations. * CVE-2026-114145: GitPython validates a submodule's '.git' path only after cloning into it (RCE). Checksums-Sha1: 908dad1e65790dd494628c3d792544c863bf2645 2822 python-git_3.1.44-1+deb13u1.dsc c479aa5a189b6ce7680edfa8f7a3d7d56c780829 544550 python-git_3.1.44.orig.tar.gz ab9f470d4277584fb512da13d89aa600641a2557 71008 python-git_3.1.44-1+deb13u1.debian.tar.xz 45259047420720d99410b37ceca8fb79a08dc87b 9963 python-git_3.1.44-1+deb13u1_source.buildinfo Checksums-Sha256: 464e17acc4b5f275cf9b8ef1e2eae1685c2310c6b3231b6da1059d2f62f841b0 2822 python-git_3.1.44-1+deb13u1.dsc 30101221a869968d4fe2a010ee9ca1134c22272089d9e9fee2040a68541443c6 544550 python-git_3.1.44.orig.tar.gz 294cfd12cc18b74f8b4a1cc48c5c1d26fc17ec5566e0e899e0064ede07a863c7 71008 python-git_3.1.44-1+deb13u1.debian.tar.xz 7a21a6c42515741d12c683b7fa44a719862392e16b4b8770e74f1c0ff0802d29 9963 python-git_3.1.44-1+deb13u1_source.buildinfo Files: d108c57ef399ce0897ddc29caf5f97f1 2822 python optional python-git_3.1.44-1+deb13u1.dsc 7e79b2d3a6e64ea5ef5a122c79723b39 544550 python optional python-git_3.1.44.orig.tar.gz 321e0b5c8a8ed9e378c621075452a746 71008 python optional python-git_3.1.44-1+deb13u1.debian.tar.xz 640c8b6e65a7a6b3efe7e4c4c2f69534 9963 python optional python-git_3.1.44-1+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmrh5NwSHGVhbWFudUBk ZWJpYW4ub3JnAAoJEPqd7F3hHGPx8f4P/3PpOYOFsZ1SuiL3bh/yta9jSalnQ1t7 2dvFdDn3Ed8SZnh/WzmzL4rpHyXvmuKl5J2S2pGaKQrz+9WafTV/ExGfluRUTUiC 6jRe+sja73dxeDYkv5hX3y9h68ur6z9OULyga76IkaZBc9me4O2yS4oPZgFv4C7F 2xhQGdgMmHKBmvXK/zbqFgfP9fke2kDWpO8eTz49KGcIioNT6yrabXlQOmOxEH+d Le5KgGFZVvweDfI3r68NV/RBZ7pq0j2EDhQkLrTJIQ4Yc+5RZQgV69p+y7prIdDl nfovFnTrEBS4lbNJK3yzco9gDEWjWXQAItXHUsAW8DdQdSzDtC+lT8XD8sBupnra hjLJOKunGMbxOfq7PQUWXPWPDLMXU8mbhi2uFnMgmUtYTTLtMKs4Z3uiY1QoahYG 77UffgE69Do2VQxLfgmaIAn0AQ4GarwOJmgjdxAGyQ/5Cw9e/Amt0X1yzHNh2fH9 z/EMv2+0BK1eYu8DGYzTwgaTb9PERlVhkyf+6tDauCB7RdyJwQ7fXhSedclXST1r YHtzK0KauE8VmxUEsvzAFcwnY4RAXwoBaClT1CkJi8sqLhJFJCCec99eCYFXjhWk TQ9S4/w5WCMtmACFP7FOG6JH/htP6ZwaR+hqSRvBvbCN/6KojBrgopTUcv3uw2Pp Q0OAtcZcZdwf =+qUj -----END PGP SIGNATURE-----