aws / aws/amazon-ssm-agent

RHEL compatibility with python vulnerability mitigation CVE-2007-4559

Open
#574 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

Hi,

When installing SSM agent on RHEL, Python is necessary. After installing on RHEL 8, we are observing errors when the agent is initializing related to being unable to download a tar file.

I came across this [CVE](https://access.redhat.com/articles/7004769) which supplies solutions for:
- updating Python code to fully declare filters from the upstream resolution
- add standalone configuration to globally tolerate and define specific filters

After reviewing SSM agent logs, I can see the following error:

`"standardError": "/usr/lib64/python3.11/tarfile.py:2253: RuntimeWarning: The default behavior of tarfile extraction has been changed to disallow common exploits (including CVE-2007-4559). By default, absolute/parent paths are disallowed and some mode bits are cleared. See https://access.redhat.com/articles/7004769 for more details.\n warnings.warn(\n"`

I was able to confirm that supplying the global filter configuration file suggested in `3.3.1` allows the agent to continue.

The guidance indicates that the ability to workaround this by changing the default behavior will not be supported beyond Python version `3.11`:

```NOTE: When Red Hat releases Python 3.12 or later, only configuration in Python will be available. The configuration file and environment variable approaches will be available only for Python versions where the default behavior has been changed up to Python 3.11.```

Contributor guide

Open the contributing guide

Research direction

Reproduce SSM agent initialization on RHEL 8 with Python 3.11 and inspect the tar download failure alongside /usr/lib64/python3.11/tarfile.py:2253. Compare the behavior with the global filter configuration described in section 3.3.1. Done means the agent can initialize and download the tar file using a supported mitigation, including when the later Python compatibility limitation applies.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, python
Domain
backend, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.