XML External Entity (XXE) Injection in OWSLib

CVE-2023-27476

What is CVE-2023-27476?

OWSLib is a Python library designed for client programming with Open Geospatial Consortium (OGC) web service standards. The library's XML parser does not disable entity resolution, creating a security flaw that enables attackers to conduct arbitrary file reads via malicious XML payloads. This issue impacts all XML parsing functions within the OWSLib codebase. To mitigate the risk, users are strongly advised to upgrade to version 0.28.1, as it addresses this vulnerability. Alternatively, users can apply a manual patch, but upgrading is recommended. For further details, refer to related security advisories.

References