Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---

fence-agents-kubevirt will need changes in two places:

- In /usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py: tf.extract(name, tmpdir)
- In /usr/lib/fence-agents/bundled/kubevirt/setuptools/archive_util.py: tarobj._extract_member

Both are in bundled libraries, and will need the fix from the following bugs backported to the bundled copy:

dateutil: https://bugzilla.redhat.com/show_bug.cgi?id=2203905
setuptools: https://bugzilla.redhat.com/show_bug.cgi?id=2207715

---

Let me know if you have any questions!