GitStock

geopython/owslib · Security

OWSLib vulnerable to XML External Entity (XXE) Injection

GHSA ID
GHSA-8h9c-r582-mggc
CVE ID
CVE-2023-27476
Severity
high
Published
Updated
CVSS
8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v3
8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Description

Impact

OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

Patches

Workarounds

patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)

References

CWEs

  • CWE-611 · Improper Restriction of XML External Entity Reference

References