+++ This bug was initially created as a clone of Bug #2217902 +++ Hello, In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way. Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.) Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior. To avoid the warning, software shipped by Red Hat will need a change. For more details see upstream PEP 706: https://peps.python.org/pep-0706 and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769 --- fence-agents will need changes in two places: - In /usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py: tf.extract(name, tmpdir) - In /usr/lib/fence-agents/bundled/kubevirt/setuptools/archive_util.py: tarobj._extract_member Both are in bundled libraries, and will need the fix from the following bugs backported to the bundled copy: dateutil: https://bugzilla.redhat.com/show_bug.cgi?id=2203905 setuptools: https://bugzilla.redhat.com/show_bug.cgi?id=2207715 --- Let me know if you have any questions!
Verified: Tested $ mkdir 2218234 $ cd 2218234 $ wget http://download.lab.eng.brq.redhat.com/rhel-8/composes/RHEL-8/RHEL-8.9.0-20230731.d.62/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.2.1-120.el8.x86_64.rpm $ wget http://download.lab.eng.brq.redhat.com/rhel-8/composes/RHEL-8/RHEL-8.9.0-20230804.d.54/compose/AppStream/x86_64/os/Packages/fence-agents-kubevirt-4.2.1-121.el8.x86_64.rpm $ rpm2cpio fence-agents-kubevirt-4.2.1-120.el8.x86_64.rpm > fence-agents-kubevirt-4.2.1-120.cpio $ rpm2cpio fence-agents-kubevirt-4.2.1-121.el8.x86_64.rpm > fence-agents-kubevirt-4.2.1-121.cpio $ cpio -idv < fence-agents-kubevirt-4.2.1-120.cpio -D 4.2.1-120 $ cpio -idv < fence-agents-kubevirt-4.2.1-121.cpio -D 4.2.1-121 $ diff 4.2.1-120/usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py 4.2.1-121/usr/lib/fence-agents/bundled/kubevirt/dateutil/zoneinfo/rebuild.py 24c24,29 < tf.extract(name, tmpdir) --- > if hasattr(tarfile, 'data_filter'): > # Python with CVE-2007-4559 mitigation (PEP 706) > tf.extract(name, tmpdir, filter='data') > else: > # Fallback to a possibly dangerous extraction (before PEP 706) > tf.extract(name, tmpdir)