Bug 2218234 - fence-agents: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation)
Summary: fence-agents: Python tarfile extraction needs change to avoid a warning (CVE-...
Keywords:
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: fence-agents
Version: 8.9
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.9
Assignee: Oyvind Albrigtsen
QA Contact: Ilias Romanos
URL:
Whiteboard:
Depends On: CVE-2007-4559 2207715 2218240 2218243 2218246 2218248 2218274 2218277
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-06-28 13:59 UTC by Charalampos Stratakis
Modified: 2023-08-16 16:09 UTC (History)
4 users (show)

Fixed In Version: fence-agents-4.2.1-121.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 2217902
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker CLUSTERQE-6827 0 None None None 2023-07-19 14:11:46 UTC
Red Hat Issue Tracker RHELPLAN-161093 0 None None None 2023-06-28 14:00:31 UTC

Description Charalampos Stratakis 2023-06-28 13:59:30 UTC
+++ This bug was initially created as a clone of Bug #2217902 +++

Hello,
In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way.
Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.)
Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior.
To avoid the warning, software shipped by Red Hat will need a change.

For more details see upstream PEP 706: https://peps.python.org/pep-0706
and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769

---
fence-agents will need changes in two places:

- In /usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py: tf.extract(name, tmpdir)
- In /usr/lib/fence-agents/bundled/kubevirt/setuptools/archive_util.py: tarobj._extract_member

Both are in bundled libraries, and will need the fix from the following bugs backported to the bundled copy:

dateutil: https://bugzilla.redhat.com/show_bug.cgi?id=2203905
setuptools: https://bugzilla.redhat.com/show_bug.cgi?id=2207715

---

Let me know if you have any questions!

Comment 3 Ilias Romanos 2023-08-16 15:09:44 UTC
Verified: Tested

$ mkdir 2218234
$ cd 2218234
$ wget http://download.lab.eng.brq.redhat.com/rhel-8/composes/RHEL-8/RHEL-8.9.0-20230731.d.62/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.2.1-120.el8.x86_64.rpm
$ wget http://download.lab.eng.brq.redhat.com/rhel-8/composes/RHEL-8/RHEL-8.9.0-20230804.d.54/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.2.1-121.el8.x86_64.rpm
$ rpm2cpio fence-agents-kubevirt-4.2.1-120.el8.x86_64.rpm > fence-agents-kubevirt-4.2.1-120.cpio
$ rpm2cpio fence-agents-kubevirt-4.2.1-121.el8.x86_64.rpm > fence-agents-kubevirt-4.2.1-121.cpio
$ cpio -idv < fence-agents-kubevirt-4.2.1-120.cpio -D 4.2.1-120
$ cpio -idv < fence-agents-kubevirt-4.2.1-121.cpio -D 4.2.1-121
$ diff 4.2.1-120/usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py 4.2.1-121/usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py 
24c24,29
<                 tf.extract(name, tmpdir)
---
>                 if hasattr(tarfile, 'data_filter'):
>                     # Python with CVE-2007-4559 mitigation (PEP 706)
>                     tf.extract(name, tmpdir, filter='data')
>                 else:
>                     # Fallback to a possibly dangerous extraction (before PEP 706)
>                     tf.extract(name, tmpdir)


Note You need to log in before you can comment on or make changes to this bug.