RHEL compatibility with python vulnerability mitigation CVE-2007-4559
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
When installing SSM agent on RHEL, Python is necessary. After installing on RHEL 8, we are observing errors when the agent is initializing related to being unable to download a tar file.
I came across this [CVE](https://access.redhat.com/articles/7004769) which supplies solutions for:
- updating Python code to fully declare filters from the upstream resolution
- add standalone configuration to globally tolerate and define specific filters
After reviewing SSM agent logs, I can see the following error:
`"standardError": "/usr/lib64/python3.11/tarfile.py:2253: RuntimeWarning: The default behavior of tarfile extraction has been changed to disallow common exploits (including CVE-2007-4559). By default, absolute/parent paths are disallowed and some mode bits are cleared. See https://access.redhat.com/articles/7004769 for more details.\n warnings.warn(\n"`
I was able to confirm that supplying the global filter configuration file suggested in `3.3.1` allows the agent to continue.
The guidance indicates that the ability to workaround this by changing the default behavior will not be supported beyond Python version `3.11`:
```NOTE: When Red Hat releases Python 3.12 or later, only configuration in Python will be available. The configuration file and environment variable approaches will be available only for Python versions where the default behavior has been changed up to Python 3.11.```
Contributor guide
Research direction
Reproduce SSM agent initialization on RHEL 8 with Python 3.11 and inspect the tar download failure alongside /usr/lib64/python3.11/tarfile.py:2253. Compare the behavior with the global filter configuration described in section 3.3.1. Done means the agent can initialize and download the tar file using a supported mitigation, including when the later Python compatibility limitation applies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, python
- Domain
- backend, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100