Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-27476

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

Published

2023-03-08T00:15:08.997

Last Modified

2024-11-21T07:52:58.840

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.2 (HIGH)

Weaknesses

Type: Primary
CWE-611

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	osgeo	owslib	< 0.28.1	Yes

References

https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f Patch ([email protected])
https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc Vendor Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html ([email protected])
https://securitylab.github.com/advisories/GHSL-2022-131_owslib/ Broken Link ([email protected])
https://www.debian.org/security/2023/dsa-5426 ([email protected])
https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html (af854a3a-2127-422b-91ae-364da2661108)
https://securitylab.github.com/advisories/GHSL-2022-131_owslib/ Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2023/dsa-5426 (af854a3a-2127-422b-91ae-364da2661108)