CVE-2023-27476: GHSL-2022-131: XML External Entities (XXE) injection in OWSLib - CVE-2023-27476
Impact
OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.
Patches
- Use only lxml for XML handling, adding resolveentities=False to lxml's parser: https://github.com/geopython/OWSLib/pull/863
Workarounds
python patchwellknownnamespaces(etree) etree.setdefaultparser( parser=etree.XMLParser(resolveentities=False) )
References
- GHSL-2022-131
Other sources
OWSLib does not disable entity resolution for XML parsing, leading to XML External Entities (XXE) injection.
— GitHub Security Lab
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See GHSA-8h9c-r582-mggc for details.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-27476?
CVE-2023-27476 is a vulnerability in the OWSLib Python package that allows arbitrary file reads from the file system.
How does CVE-2023-27476 occur?
CVE-2023-27476 occurs because OWSLib's XML parser does not disable entity resolution.
What is the severity of CVE-2023-27476?
CVE-2023-27476 has a severity rating of 7.5 (high).
Which versions of OWSLib are affected by CVE-2023-27476?
OWSLib versions up to and including 0.28.1 are affected by CVE-2023-27476.
How can I fix CVE-2023-27476?
To fix CVE-2023-27476, update OWSLib to version 0.29.2-1 or higher.