XML External Entity (XXE) Injection in OWSLib
概要
XML External Entity (XXE) Injection in OWSLib
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-27476 owslib 修正版: 0.23.0-1+deb11u1
- Ubuntu UBUNTU-CVE-2023-27476 owslib
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- advisory debian.org
- web github.com
- web lists.debian.org