Comment 84 for bug 1996188

Revision history for this message
Brian Rosmaita (brian-rosmaita) wrote : Re: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

I was looking into what it would take to backport this to train, and once I hit py27 tests, I realized that I didn't actually (contrary to the commit message) remove all the type annotations from the patch to wallaby (comment #56). So I will update that patch today.

In the meantime, I also hit a problem in that whereas I was able to run unit tests and pep8 locally on the posted patches for the supported pythons in each release back in December, something has changed in my local environment and tox (3!!!) can't build the testenvs starting with xena backward due to oslo.vmware having suds-jurko as a requirement, and whatever setuptools I've got can't build suds-jurko. This doesn't seem to have hit the periodic stable jobs because they use a pre-built wheel.

My local workaround is to use a modified upper-constraints file that has 'oslo.vmware===3.10.0', which is the yoga release of oslo.vmware, and the only difference from the xena version is that it uses suds-community instead of suds-jurko. Does anyone know a better workaround? I'm worried that operators will want to at least run unit tests before applying the patches, and I at least can't do that locally without making some non-obvious adjustments.