-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 28 Oct 2026 08:40:08 -0300 Source: python-git Binary: python-git-doc python3-git Architecture: all Version: 3.1.44-1+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Emmanuel Arias Description: python-git-doc - Python library to interact with Git repositories - docs python3-git - Python library to interact with Git repositories Closes: 1135349 1135350 1143454 1143602 1144344 1144929 Changes: python-git (3.1.44-1+deb13u1) trixie-security; urgency=medium . * CVE-2026-42215: block unsafe options passed as underscored kwargs (Closes: #1135349). * CVE-2026-42284: check unsafe options after splitting multi_options with shlex (Closes: #1135350). * CVE-2026-44243: prevent access to files outside the repository when manipulating references. * CVE-2026-44244: reject control characters in config values written by the config writer, preventing config injection. * CVE-2026-67322: do not expand environment variables in clone URLs, which could leak secrets to a remote host (Closes: #1143454). * CVE-2026-67323: guard unsafe options (--exec, --upload-pack, ...) in archive, fetch, pull, push, ls-remote, blame and revision APIs. * CVE-2026-67324, CVE-2026-67325: abbreviated long options and joined short options bypassed the unsafe option checks, leading to command execution. * CVE-2026-67326: config section names were not validated before writing, allowing config injection. * CVE-2026-69097: config section names containing an unquoted closing bracket could inject arbitrary settings into .git/config (Closes: #1143602). * CVE-2026-73619: add --add-file, --add-virtual-file (archive) and --bundle-uri (clone) to the unsafe option lists (Closes: #1144344). * CVE-2026-73620: block unsafe options in IndexFile.checkout() (--prefix) and TagReference.create() (-F/--file), which could write to or read from arbitrary filesystem paths. * CVE-2026-73621: reject unsafe output options in Commit.count. * CVE-2026-73622: do not expand environment variables in remote and submodule URLs, which could leak secrets to a remote host. * CVE-2026-73623: reject unsafe --template option when cloning. * CVE-2026-73624: guard unsafe output options in diff operations. * CVE-2026-73625: validate the values of split short options, which could bypass the unsafe option checks in clone, remote, revision, blame and archive operations. * CVE-2026-76217: guard --pathspec-from-file options in IndexFile.remove, Head.checkout and HEAD.reset (Closes: #1144929). * CVE-2026-76218: guard unsafe git init options (--template, --separate-git-dir) in Repo.init. * CVE-2026-76219: guard --index-output in read-tree calls made by from_tree, merge_tree and reset, which could write to an arbitrary path. * CVE-2026-76220: check the value joined to one-character options when split_single_char_options is false, which could bypass the unsafe option checks. * CVE-2026-76221: reject config option names containing characters that could inject arbitrary settings when writing the config. * CVE-2026-76222: validate submodule names read from .gitmodules before filesystem operations, preventing path traversal outside the repository. * CVE-2026-78675: do not process include directives in .gitmodules, which could read arbitrary files. * CVE-2026-78676: preserve multiline config values when writing, which could otherwise inject new options into the config. * CVE-2026-78677: block --separate-git-dir in Repo.clone() and Repo.clone_from(), which could write repository metadata to an arbitrary path. * CVE-2026-78678, CVE-2026-78679: block file-reading options in blame, diff and tag APIs, which could read arbitrary files. * CVE-2026-87817: prefer the .git entry during repository discovery and validate candidate git directories, aligning the behaviour with git. * CVE-2026-87818: treat --no-index as an unsafe diff option, since it allows diffing arbitrary filesystem paths. * CVE-2026-87819: parse actor identities without regular expressions, avoiding quadratic backtracking (ReDoS) on malformed identities. * CVE-2026-100689: reject submodule checkout paths that resolve outside the repository or through a symbolic link, applying to Submodule.update the containment check already used by add and move. * CVE-2026-110855: do not expand environment variables in the separate_git_dir path when cloning, preserving literal paths so repository metadata is not written to an unexpected location * CVE-2026-110856: parse actor identities and dates in commit authors, committers and taggers without backtracking regular expressions, avoiding excessive CPU use (ReDoS) on malformed metadata. * CVE-2026-110857: complete the unsafe option and protocol checks in Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which previously omitted guards already used by sibling APIs. * CVE-2026-110858: reject option-shaped remote names in Remote.update(), which git forwards to "fetch --multiple" without an option terminator, allowing a leading-dash name to change the requested operation. * CVE-2026-110859: validate the positional reference passed by Head.checkout() against the unsafe-option policy, since reference names originating in a cloned repository could otherwise bypass it. * CVE-2026-110860: reject submodule checkout, move and metadata paths that traverse intermediate symbolic links before performing filesystem operations. * CVE-2026-114145: GitPython validates a submodule's '.git' path only after cloning into it (RCE). Checksums-Sha1: 3544b945a68b7e72f37929dc019125cb08efe3f8 200052 python-git-doc_3.1.44-1+deb13u1_all.deb ac305f1dc412725781013d080b8a68355afff9d2 8487 python-git_3.1.44-1+deb13u1_all-buildd.buildinfo 51891947d98e508278c8cf36d480e47c9dc25115 155092 python3-git_3.1.44-1+deb13u1_all.deb Checksums-Sha256: 7ee39f14bd90fc9027b7c4c7458943b9ab48797fe9b2dd20a04c6156ceb5bf10 200052 python-git-doc_3.1.44-1+deb13u1_all.deb 3026192a0052920d81bdf96e841561b496e661db0501dbbbae4e251c738b3a63 8487 python-git_3.1.44-1+deb13u1_all-buildd.buildinfo 53b6a3e35c32d43931f6833b1c63abaabb4f885b384e93e59a6706d9f76d5747 155092 python3-git_3.1.44-1+deb13u1_all.deb Files: c431b803c51e7ea214f2843dd112d4cb 200052 doc optional python-git-doc_3.1.44-1+deb13u1_all.deb d82a4e7ee074b1fac8b4bd6743c50e38 8487 python optional python-git_3.1.44-1+deb13u1_all-buildd.buildinfo 8d4933e1d1148c66ff118d48f0168ae3 155092 python optional python3-git_3.1.44-1+deb13u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmriTc8ACgkQmgPNRvTf /zcWzxAAiwbqCiPEvPFJrEQZQ1kHX4ka25RU8kH4fa1pw98GwZNwH9rgrUa6RpBn 3o5JRo9LmStHIedIPSuGk56kBH4s8H19Rw55QRKf//pEDvhezSLFcmCnWOtePvSw ejij2gdZV35WAHUUyt9Udfb4SQMoFj5E7LqRiFKAqZzNxTs9+mDLq1TMFhCAHbn8 DEUVg8rzwpCNBXl6di+IegOA5I2dDo9JdoldujVdRUK2dHFd7K+hcIyHhd5AAShC xjhc49FxMedy6AbDWTpQUHnc3f68dTSRJIGbRYM7i7vbI0MS03ukJYDe9d7mpyJh SLCdCOcdgsyAvISHDc9rPPeBujk5jrVBTi8IKYzMinv/XRphEh4l4n9104oG9vtm 25W8P5iHoh44zC+BAqj9DPJGqQWivGyYLqeHXJaeeN+GknhKt8F9qh1BApiXTCsV 2mM+Z4kQK+gGnEiB5v+lERfR4aVTy6SMkKbcoxPMf5In6ewll8qIThlfQ56Ub/lB HmsxUqMRHiMXeufmI3k3Mud5NbgBkafjdGkcWdE/SxcvoeGqbQjgJ2yDx2BoaalI eo1VPbhLhdUekqKercROWEHZE3yKu0JVKoJUrNXbZdhiONxzdYJq2I6nnxOuIQVX WT/BBm9P3CCkllD7DkriaO245aL9m3t4if8zeyGt4M2pAg0n8jM= =aySK -----END PGP SIGNATURE-----