Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04aDljLXI1ODItbWdnY84AAx-f

OWSLib vulnerable to XML External Entity (XXE) Injection

Impact

OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

Patches

• Use only lxml for XML handling, adding resolve_entities=False to lxml's parser: https://github.com/geopython/OWSLib/pull/863

Workarounds

patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)

References

• GHSL-2022-131

Permalink: https://github.com/advisories/GHSA-8h9c-r582-mggc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04aDljLXI1ODItbWdnY84AAx-f
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 11 months ago

CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Identifiers: GHSA-8h9c-r582-mggc, CVE-2023-27476
References:

• https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc
• https://github.com/geopython/OWSLib/pull/863
• https://github.com/geopython/OWSLib/releases/tag/0.28.1
• https://nvd.nist.gov/vuln/detail/CVE-2023-27476
• https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f
• https://securitylab.github.com/advisories/GHSL-2022-131_owslib/
• https://www.debian.org/security/2023/dsa-5426
• https://github.com/pypa/advisory-database/tree/main/vulns/owslib/PYSEC-2023-86.yaml
• https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html
• https://github.com/advisories/GHSA-8h9c-r582-mggc

Repository: https://github.com/geopython/OWSLib
Blast Radius: 18.4

Affected Packages