Bug 2218235

Summary:	python3-lib389: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation)
Product:	Red Hat Enterprise Linux 8	Reporter:	Charalampos Stratakis <cstratak>
Component:	389-ds-base	Assignee:	LDAP Maintainers <idm-ds-dev-bugs>
Status:	CLOSED ERRATA	QA Contact:	LDAP QA Team <idm-ds-qe-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.9	CC:	bsmejkal, idm-ds-dev-bugs, idm-ds-qe-bugs, mreynolds, pviktori, vashirov
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	389-ds-1.4-820230816162424-17499975	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2207691	Environment:
Last Closed:	2023-11-14 15:32:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	263261

Description Charalampos Stratakis 2023-06-28 14:01:56 UTC

+++ This bug was initially created as a clone of Bug #2207691 +++

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

In __init__.py and tools.py in /usr/lib/python3.9/site-packages/lib389/, lib389 calls `tar.extract()`. The calls will emit a warning by default, and tar features deemed too dangerous for general use will even be blocked by default.

It seems that this is a backup recovery, and you trust the archive to not be malicious. In that case, add the following after the `tar = tarfile.open(backup_file)`:

    # The archive is fully trusted, override warnings and "safe" defaults
    # see https://docs.python.org/3.12/library/tarfile.html#supporting-older-python-versions
    tar.extraction_filter = (lambda member, path: member)

This will restore previous behaviour, and it's a no-op on earlier Python versions.

---

Let me know if you have any questions!

Comment 2 Viktor Ashirov 2023-08-21 12:54:26 UTC

Builds tested: 
389-ds-base-1.4.3.37-1.module+el8.9.0+19689+7d653af8.x86_64
python3-lib389-1.4.3.37-1.module+el8.9.0+19689+7d653af8.noarch

A filter was added:
$ grep -inr -A1  tarfile.open /usr/lib/python3.6/site-packages/lib389
/usr/lib/python3.6/site-packages/lib389/__init__.py:1368:        tar = tarfile.open(backup_file, "w:gz")
/usr/lib/python3.6/site-packages/lib389/__init__.py-1369-        tar.extraction_filter = (lambda member, path: member)
--
/usr/lib/python3.6/site-packages/lib389/__init__.py:1438:        tar = tarfile.open(backup_file)
/usr/lib/python3.6/site-packages/lib389/__init__.py-1439-        tar.extraction_filter = (lambda member, path: member)
--
/usr/lib/python3.6/site-packages/lib389/tools.py:302:        tar = tarfile.open(backup_file, "w:gz")
/usr/lib/python3.6/site-packages/lib389/tools.py-303-        tar.extraction_filter = (lambda member, path: member)
--
/usr/lib/python3.6/site-packages/lib389/tools.py:361:        tar = tarfile.open(backup_file)
/usr/lib/python3.6/site-packages/lib389/tools.py-362-        tar.extraction_filter = (lambda member, path: member)

Moreover, this code is in functions that are not used by any other code in lib389:
lib389.backupFS
lib389.restoreFS
lib389.tools.instanceBackupFS
lib389.tools.instanceRestoreFS

These were implemented to speed up testing, but since then were replaced by pytest fixtures. They will be removed in https://github.com/389ds/389-ds-base/issues/5875

Comment 6 errata-xmlrpc 2023-11-14 15:32:25 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (389-ds:1.4 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6965