Bug 2218235

Summary: python3-lib389: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation)
Product: Red Hat Enterprise Linux 8 Reporter: Charalampos Stratakis <cstratak>
Component: 389-ds-baseAssignee: LDAP Maintainers <idm-ds-dev-bugs>
Status: MODIFIED --- QA Contact: LDAP QA Team <idm-ds-qe-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.9CC: bsmejkal, idm-ds-dev-bugs, idm-ds-qe-bugs, mreynolds, pviktori, vashirov
Target Milestone: rcKeywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: sync-to-jira
Fixed In Version: 389-ds-1.4-820230816162424-17499975 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2207691 Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 263261    
Bug Blocks:    

Description Charalampos Stratakis 2023-06-28 14:01:56 UTC 
+++ This bug was initially created as a clone of Bug #2207691 +++

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

In __init__.py and tools.py in /usr/lib/python3.9/site-packages/lib389/, lib389 calls `tar.extract()`. The calls will emit a warning by default, and tar features deemed too dangerous for general use will even be blocked by default.

It seems that this is a backup recovery, and you trust the archive to not be malicious. In that case, add the following after the `tar = tarfile.open(backup_file)`:

    # The archive is fully trusted, override warnings and "safe" defaults
    # see https://docs.python.org/3.12/library/tarfile.html#supporting-older-python-versions
    tar.extraction_filter = (lambda member, path: member)

This will restore previous behaviour, and it's a no-op on earlier Python versions.

---

Let me know if you have any questions!