CVE-2023-27476

published 2023-03-08

CVE-2023-27476: OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	owslib	< owslib 0.27.2-3 (bookworm)	owslib 0.27.2-3 (bookworm)
geopython	owslib	< 0.28.1	0.28.1
osgeo	owslib	< 0.28.1	0.28.1
osgeo	owslib	>= 0 < 0.23.0-1+deb11u1	0.23.0-1+deb11u1
osgeo	owslib	>= 0 < 0.27.2-3	0.27.2-3
osgeo	owslib	>= 0 < 0.27.2-3	0.27.2-3
osgeo	owslib	>= 0 < 0.27.2-3	0.27.2-3
osgeo	owslib	>= 0 < 0.28.1	0.28.1
ubuntu	owslib	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

osv 7.5 HIGH

vendor_debian 8.2 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611