GHSA-8h9c-r582-mggcHighCVSS 8.2

OWSLib vulnerable to XML External Entity (XXE) Injection

Published
March 7, 2023
Last Modified
October 7, 2024

🔗 CVE IDs covered (1)

CVE-2023-27476 →

📋 Description

Impact

OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

Patches

  • Use only lxml for XML handling, adding resolve_entities=False to lxml's parser: https://github.com/geopython/OWSLib/pull/863

Workarounds

patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)

References

🎯 Affected products1

  • pip/OWSLib:< 0.28.1

🔗 References (10)