GitHub Advisoryadvisory · PyPI

GHSA-8h9c-r582-mggc OWSLib vulnerable to XML External Entity (XXE) Injection

HIGH Published 2023-03-07 Modified 2024-10-07 Official page ↗
Aliases
CVE-2023-27476
Ecosystem
PyPI
Packages
OWSLib
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weaknesses
CWE-611
Reviewed
2023-03-07

Affected packages

• PyPI OWSLib: < 0.28.1 → fixed in 0.28.1

Description

Impact OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. Patches • Use only lxml for XML handling, adding `resolve_entities=False` to `lxml`'s parser: https://github.com/geopython/OWSLib/pull/863 Workarounds ```python patch_well_known_namespaces(etree) etree.set_default_parser( parser=etree.XMLParser(resolve_entities=False) ) ``` References • `GHSL-2022-131`

Related

Alias · CVE (1)

  • CVE-2023-27476 OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References