Bug 2218246

Summary: [RHEL9]python3.11-setuptools: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation)
Product: Red Hat Enterprise Linux 9 Reporter: Charalampos Stratakis <cstratak>
Component: python3.11-setuptoolsAssignee: Python Maintainers <python-maint>
Status: CLOSED NOTABUG QA Contact: Lukáš Zachar <lzachar>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 9.3CC: cstratak, pviktori, python-maint, rhel-cs-apps-subsystem-qe
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2207715
: 2218248 (view as bug list) Environment:
Last Closed: 2023-07-11 14:44:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 263261, 2217897, 2217902, 2218234    

Description Charalampos Stratakis 2023-06-28 14:18:39 UTC 
+++ This bug was initially created as a clone of Bug #2207715 +++

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

The file to change is /usr/lib/python3.*/site-packages/setuptools/archive_util.py. We probably want the 'tar' filter here, for a quick fix.
Comment 1 Petr Viktorin (pviktori) 2023-07-11 14:44:20 UTC 
On closer inspection, the extraction code in setuptools
- avoids the CVE by avoiding symlinks and parent directory traversal
- avoids the warning by using undocumented internals
- is only used in deprecated paths (easy_install, install_egg_info) and tests

I'll close this as not affected.