+++ This bug was initially created as a clone of Bug #2207715 +++ Hello, In RHEL 9.3 and 8.9, we're planning to fix the long-standing CVE-2007-4559: Python's `tarfile` module makes it too easy to extract tarballs in an unsafe way. Unfortunately, for the CVE to be considered fixed, this needs a behavior change. (If you don't think this is the case, let's bring it up with the security team.) Upstream, Python will emit deprecation warnings for 2 releases, but in RHEL we change the behavior now, emit warnings, and provide ways for customers to restore earlier behavior. To avoid the warning, software shipped by Red Hat will need a change. For more details see upstream PEP 706: https://peps.python.org/pep-0706 and the Red Hat knowledge base draft: https://access.redhat.com/articles/7004769 --- The file to change is /usr/lib/python3.*/site-packages/setuptools/archive_util.py. We probably want the 'tar' filter here, for a quick fix.
On closer inspection, the extraction code in setuptools - avoids the CVE by avoiding symlinks and parent directory traversal - avoids the warning by using undocumented internals - is only used in deprecated paths (easy_install, install_egg_info) and tests I'll close this as not affected.