Rocky Linux 8.10 + Python old removal

Rocky Linux Help & Support
1

Hi Community,

As part of the analysis for CVE-2017-18342, it was identified that /usr/sbin/nfsdclnts (a Python wrapper) invokes PyYAML using yaml.load(..., Loader=yaml.BaseLoader) instead of the recommended yaml.safe_load() API. Although the implementation uses BaseLoader, the presence of yaml.load() causes vulnerability scanners to flag the system with a Critical finding.

The YAML input processed by the utility is read from kernel-generated NFS state files under /proc/fs/nfsd/clients/*/states and is not user-controlled or network-supplied. Since nfs-utils is required for application functionality, it cannot be removed. Since the package is nfs-utils is basically from Rocky Linux, could the Rocky Linux community clarify whether there are plans to update nfsdclnts to use yaml.safe_load() in a future release? Alternatively, is there a supported and safe approach to migrate from the older system Python/PyYAML version to a newer supported version without impacting the operating system?

Any information will be a great help.

Thank you.

2

Since the package is basically same as in RHEL, it is Red Hat whose plans for RHEL that do matter. You should report issue to them / ask from them.

4

Thanks for the input, will raise this concern with Redhat and let you know what is their take.

5

Yes, we understand. However, since the release image cannot be changed due to our contractual commitments, we have to document this in the release notes for every release. This prompted us to investigate the issue further and identify a permanent solution, rather than continuing to address it through release notes each time.