Bug 2217902

Summary:	fence-agents: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation)
Product:	Red Hat Enterprise Linux 9	Reporter:	Petr Viktorin (pviktori) <pviktori>
Component:	fence-agents	Assignee:	Oyvind Albrigtsen <oalbrigt>
Status:	CLOSED ERRATA	QA Contact:	Ilias Romanos <iromanos>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.3	CC:	bperkins, cluster-maint
Target Milestone:	rc	Keywords:	Triaged
Target Release:	9.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	fence-agents-4.10.0-55.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2218234 (view as bug list)		Environment:
Last Closed:	2023-11-07 08:26:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2207715, 2218240, 2218243, 2218246, 2218248, 2218274, 2218277
Bug Blocks:	263261

Description Petr Viktorin (pviktori) 2023-06-27 12:25:32 UTC

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---
fence-agents will need changes in two places:

- In /usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py: tf.extract(name, tmpdir)
- In /usr/lib/fence-agents/bundled/kubevirt/setuptools/archive_util.py: tarobj._extract_member

Both are in bundled libraries, and will need the fix from the following bugs backported to the bundled copy:

dateutil: https://bugzilla.redhat.com/show_bug.cgi?id=2203905
setuptools: https://bugzilla.redhat.com/show_bug.cgi?id=2207715

---

Let me know if you have any questions!

Comment 3 Ilias Romanos 2023-08-16 15:09:06 UTC

Verified: Tested

$ mkdir 2217902
$ cd 2217902
$ wget http://download.lab.eng.brq.redhat.com/rhel-9/composes/RHEL-9/RHEL-9.3.0-20230731.0/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.10.0-48.el9.x86_64.rpm
$ wget http://download.lab.eng.brq.redhat.com/rhel-9/composes/RHEL-9/RHEL-9.3.0-20230805.d.22/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.10.0-55.el9.x86_64.rpm
$ rpm2cpio fence-agents-kubevirt-4.10.0-48.el9.x86_64.rpm > fence-agents-kubevirt-4.10.0-48.cpio
$ rpm2cpio fence-agents-kubevirt-4.10.0-55.el9.x86_64.rpm > fence-agents-kubevirt-4.10.0-55.cpio
$ cpio -idv < fence-agents-kubevirt-4.10.0-48.cpio -D 4.10.0-48
$ cpio -idv < fence-agents-kubevirt-4.10.0-55.cpio -D 4.10.0-55
$ diff 4.10.0-48/usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py 4.10.0-55/usr/lib/fence-agents/support/kubevirt/dateutil/zoneinfo/rebuild.py 
24c24,29
<                 tf.extract(name, tmpdir)
---
>                 if hasattr(tarfile, 'data_filter'):
>                     # Python with CVE-2007-4559 mitigation (PEP 706)
>                     tf.extract(name, tmpdir, filter='data')
>                 else:
>                     # Fallback to a possibly dangerous extraction (before PEP 706)
>                     tf.extract(name, tmpdir)

Comment 6 Ilias Romanos 2023-08-19 18:21:03 UTC

VERIFIED:

[root@virt-505 ~]# rpm -q fence-agents-kubevirt
fence-agents-kubevirt-4.10.0-55.el9.x86_64

[root@virt-505 ~]# grep -B1 -A4 CVE-2007-4559 /usr/lib/fence-agents/support/kubevirt/dateutil/zoneinfo/rebuild.py
                if hasattr(tarfile, 'data_filter'):
                    # Python with CVE-2007-4559 mitigation (PEP 706)
                    tf.extract(name, tmpdir, filter='data')
                else:
                    # Fallback to a possibly dangerous extraction (before PEP 706)
                    tf.extract(name, tmpdir)

Comment 8 errata-xmlrpc 2023-11-07 08:26:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (fence-agents bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6362