SOURCES/cve-2007-4559-tarfile.patch

@@ -0,0 +1,78 @@
+Minimal patch for pip
+
+diff -rU3 pip-22.3.1-orig/src/pip/_internal/utils/unpacking.py pip-22.3.1/src/pip/_internal/utils/unpacking.py
+--- pip-22.3.1-orig/src/pip/_internal/utils/unpacking.py	2022-11-05 16:25:43.000000000 +0100
++++ pip-22.3.1/src/pip/_internal/utils/unpacking.py	2023-08-08 13:17:47.705613554 +0200
+@@ -184,6 +184,13 @@
+                     "outside target directory ({})"
+                 )
+                 raise InstallationError(message.format(filename, path, location))
++
++            # Call the `data` filter for its side effect (raising exception)
++            try:
++                tarfile.data_filter(member.replace(name=fn), location)
++            except tarfile.LinkOutsideDestinationError:
++                pass
++
+             if member.isdir():
+                 ensure_dir(path)
+             elif member.issym():
+
+
+Test from https://github.com/pypa/pip/pull/12214
+
+diff -rU3 pip-22.3.1-orig/tests/unit/test_utils_unpacking.py pip-22.3.1/tests/unit/test_utils_unpacking.py
+--- pip-22.3.1-orig/tests/unit/test_utils_unpacking.py	2022-11-05 16:25:43.000000000 +0100
++++ pip-22.3.1/tests/unit/test_utils_unpacking.py	2023-08-08 13:17:35.151540108 +0200
+@@ -171,6 +171,23 @@
+         test_tar = self.make_tar_file("test_tar.tar", files)
+         untar_file(test_tar, self.tempdir)
+ 
++    def test_unpack_tar_filter(self) -> None:
++        """
++        Test that the tarfile.data_filter is used to disallow dangerous
++        behaviour (PEP-721)
++        """
++        test_tar = os.path.join(self.tempdir, "test_tar_filter.tar")
++        with tarfile.open(test_tar, "w") as mytar:
++            file_tarinfo = tarfile.TarInfo("bad-link")
++            file_tarinfo.type = tarfile.SYMTYPE
++            file_tarinfo.linkname = "../../../../pwn"
++            mytar.addfile(file_tarinfo, io.BytesIO(b""))
++        with pytest.raises(InstallationError) as e:
++            untar_file(test_tar, self.tempdir)
++
++        assert "is outside the destination" in str(e.value)
++
++
+ 
+ def test_unpack_tar_unicode(tmpdir: Path) -> None:
+     test_tar = tmpdir / "test.tar"
+
+
+Patch for vendored distlib from https://github.com/pypa/distlib/pull/201
+
+diff --git a/distlib/util.py b/distlib/util.py
+index e0622e4..4349d0b 100644
+--- a/src/pip/_vendor/distlib/util.py
++++ b/src/pip/_vendor/distlib/util.py
+@@ -1249,6 +1249,19 @@ def check_path(path):
+             for tarinfo in archive.getmembers():
+                 if not isinstance(tarinfo.name, text_type):
+                     tarinfo.name = tarinfo.name.decode('utf-8')
++
++        # Limit extraction of dangerous items, if this Python
++        # allows it easily. If not, just trust the input.
++        # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
++        def extraction_filter(member, path):
++            """Run tarfile.tar_fillter, but raise the expected ValueError"""
++            # This is only called if the current Python has tarfile filters
++            try:
++                return tarfile.tar_filter(member, path)
++            except tarfile.FilterError as exc:
++                raise ValueError(str(exc))
++        archive.extraction_filter = extraction_filter
++
+         archive.extractall(dest_dir)
+ 
+     finally:

SPECS/python3.11-pip.spec

@@ -12,7 +12,7 @@
 
 Name:           python%{python3_pkgversion}-%{srcname}
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        2%{?dist}
+Release:        5%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -81,6 +81,14 @@ Patch2:         nowarn-pip._internal.main.patch
 # Upstream issue: https://github.com/pypa/packaging/issues/368
 Patch3:         no-version-warning.patch
 
+# CVE-2007-4559, PEP-721, PEP-706: Use tarfile.data_filter for extracting
+# - Minimal downstream-only patch, to be replaced by upstream solution
+#   proposed in https://github.com/pypa/pip/pull/12214
+# - Test patch submitted upstream in the above pull request
+# - Patch for vendored distlib, accepted upstream:
+#   https://github.com/pypa/distlib/pull/201
+Patch4:         cve-2007-4559-tarfile.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -199,7 +207,9 @@ Recommends:     python%{python3_pkgversion}-setuptools
 Requires(postun): alternatives >= 1.19.1-1
 
 # python3.11 installs the alternatives master symlink to which we attach a slave
-Requires: python%{python3_pkgversion}
+# pip has to require explicit version of python that provides
+# filters in tarfile module (fix for CVE-2007-4559).
+Requires: python%{python3_pkgversion} >= 3.11.4-3
 Requires(post): python%{python3_pkgversion}
 Requires(postun): python%{python3_pkgversion}
 
@@ -217,6 +227,8 @@ Packages" or "Pip Installs Python".
 %package -n     %{python_wheel_pkg_prefix}-%{srcname}-wheel
 Summary:        The pip wheel
 Requires:       ca-certificates
+# Older Python does not provide tarfile filters (fix for CVE-2007-4559).
+Conflicts:      python%{python3_pkgversion} < 3.11.4-3
 
 # Virtual provides for the packages bundled by pip:
 %{bundled %{python3_pkgversion}}
@@ -389,34 +401,46 @@ fi
 %{python_wheel_dir}/%{python_wheel_name}
 
 %changelog
+* Wed Feb 14 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 22.3.1-5
+- Require Python with tarfile filters
+Resolves: RHEL-25453
+
+* Tue Aug 08 2023 Petr Viktorin <pviktori@redhat.com> - 22.3.1-4
+- Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
+Resolves: RHBZ#2218249
+
+* Mon Mar 06 2023 Lumír Balhar <lbalhar@redhat.com> - 22.3.1-3
+- Fix changelog to contain Fedora contributors
+Resolves: RHEL-232
+
 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-2
 - Add BuildRequires on python3.11-rpm-macros
 
 * Wed Aug 03 2022 Charalampos Stratakis <cstratak@redhat.com> - 22.3.1-1
 - Initial package
 - Fedora contributions by:
-      # Bill Nottingham <notting@fedoraproject.org>
+    Bill Nottingham <notting@fedoraproject.org>
-      # Charalampos Stratakis <cstratak@redhat.com>
+    Charalampos Stratakis <cstratak@redhat.com>
-      # David Malcolm <dmalcolm@redhat.com>
+    David Malcolm <dmalcolm@redhat.com>
-      # Dennis Gilmore <dennis@ausil.us>
+    Dennis Gilmore <dennis@ausil.us>
-      # Jon Ciesla <limburgher@gmail.com>
+    Jon Ciesla <limburgher@gmail.com>
-      # Karolina Surma <ksurma@redhat.com>
+    Karolina Surma <ksurma@redhat.com>
-      # Kevin Fenzi <kevin@fedoraproject.org>
+    Kevin Fenzi <kevin@fedoraproject.org>
-      # Kevin Kofler <Kevin@tigcc.ticalc.org>
+    Kevin Kofler <Kevin@tigcc.ticalc.org>
-      # Luke Macken <lmacken@redhat.com>
+    Luke Macken <lmacken@redhat.com>
-      # Lumir Balhar <lbalhar@redhat.com>
+    Lumir Balhar <lbalhar@redhat.com>
-      # Marcel Plch <mplch@redhat.com>
+    Marcel Plch <mplch@redhat.com>
-      # Matej Stuchlik <mstuchli@redhat.com>
+    Matej Stuchlik <mstuchli@redhat.com>
-      # Michal Cyprian <m.cyprian@gmail.com>
+    Michal Cyprian <m.cyprian@gmail.com>
-      # Miro Hrončok <miro@hroncok.cz>
+    Miro Hrončok <miro@hroncok.cz>
-      # Orion Poplawski <orion@cora.nwra.com>
+    Orion Poplawski <orion@cora.nwra.com>
-      # Pádraig Brady <P@draigBrady.com>
+    Pádraig Brady <P@draigBrady.com>
-      # Peter Halliday <hoangelos@fedoraproject.org>
+    Peter Halliday <hoangelos@fedoraproject.org>
-      # Petr Viktorin <pviktori@redhat.com>
+    Petr Viktorin <pviktori@redhat.com>
-      # Robert Kuska <rkuska@redhat.com>
+    Robert Kuska <rkuska@redhat.com>
-      # Slavek Kabrda <bkabrda@redhat.com>
+    Slavek Kabrda <bkabrda@redhat.com>
-      # Tim Flink <tflink@fedoraproject.org>
+    Tim Flink <tflink@fedoraproject.org>
-      # Tomáš Hrnčiar <thrnciar@redhat.com>
+    Tomáš Hrnčiar <thrnciar@redhat.com>
-      # Tomas Orsava <torsava@redhat.com>
+    Tomas Orsava <torsava@redhat.com>
-      # Toshio Kuratomi <toshio@fedoraproject.org>
+    Toshio Kuratomi <toshio@fedoraproject.org>
-      # Ville Skyttä <ville.skytta@iki.fi>
+    Ville Skyttä <ville.skytta@iki.fi>