XML External Entity (XXE) Injection in OWSLib
Summary
XML External Entity (XXE) Injection in OWSLib
Original description
The description as published by the source.
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-27476 owslib Fixed in: 0.23.0-1+deb11u1
- Ubuntu UBUNTU-CVE-2023-27476 owslib
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- advisory debian.org
- web github.com
- web lists.debian.org