Skip to content
OpenAdvisories
High · 8.2 CVE-2023-27476 EUVD-2023-0189GHSA-8h9c-r582-mggcPYSEC-2023-86

XML External Entity (XXE) Injection in OWSLib

Published Mar 7, 2023 · Updated Feb 25, 2025 · Assigned by GitHub_M

Vendor: geopython Product: OWSLib Package: owslib Package: owslib Package: owslib Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

Affected products

VendorProductAffectedFixed
geopython OWSLib < 0.28.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 owslib 0.27.2-3 —
Debian 13 owslib 0.27.2-3 —
Debian 12 owslib 0.27.2-3 —
Debian 11 owslib 0.23.0-1+deb11u1 DSA-5426-1
Debian 10 owslib 0.17.1-1+deb10u1 DLA-3470-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS owslib 0.25.0-1ubuntu0.1~esm1 —
Ubuntu Pro 20.04 LTS owslib 0.19.1-1ubuntu0.1~esm1 —
Ubuntu Pro 18.04 LTS owslib 0.16.0-1ubuntu0.1~esm1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI owslib < 0.28.1 0.28.1 GHSA-8h9c-r582-mggc

Advisories 2

References