Bug 2218870

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

In /usr/lib/python3.6/site-packages/redhat_support_tool/helpers/soscleaner.py, redhat-support-tool calls `p.extractall()`. The call will emit a warning by default. Something like this should be added before the call:

p.extraction_filter = getattr(tarfile, 'data_filter',
                              (lambda member, path: member))

This is compatible with unpatched versions of Python. If you only build for RHEL8.9+, instead add an argument to the call:
p.extractall(self.origin_path, filter='data')

The 'data_filter' above attempts a "safe" extraction, intended for pure data archives. For example:
- prevents extracting outside the target directory, and to absolute paths (by raising an exception)
- prevents symlinks pointing outside the target directory, and to absolute paths
- adjusts permissions (for the owner, only the executable bit is honored)
See PEP 706 for details: https://peps.python.org/pep-0706/#filters

You can additionally set `p.errorlevel = 0` to skip extracting "bad" files with a warning on stderr.

If you trust the tarball, use `'fully_trusted_filter'` (or `filter='fully_trusted'`) instead. That will preserve the existing behavior.

---

Let me know if you have any questions!