Bug 2218240

+++ This bug was initially created as a clone of Bug #2203905 +++

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

/usr/lib/python3.9/site-packages/dateutil/zoneinfo/rebuild.py has a tarfile extraction call that'll need changing from:

                tf.extract(name, tmpdir)

to something like:

if hasattr(tarfile, 'data_filter'):
    # Python with CVE-2007-4559 mitigation (PEP 706)
    tf.extract(name, tmpdir, filter='data')
else:
    # Fallback to a possibly dangerous extraction (before PEP 706)
    tf.extract(name, tmpdir)


Or just add the filter='data' if we can coordinate updates.

--- Additional comment from Petr Viktorin on 2023-06-27 17:32:36 CEST ---

Upstream is removing tarfile handling, so they rejected the patch. But we should backport it to existing releases.