CVE-2023-27476
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-611
Restricción incorrecta de referencia a entidad externa XML (XXE)
Fecha de publicación:
08/03/2023
Última modificación:
25/06/2023
Descripción
*** Pendiente de traducción *** OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:osgeo:owslib:*:*:*:*:*:*:*:* | 0.28.1 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f
- https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc
- https://lists.debian.org/debian-lts-announce/2023/06/msg00032.html
- https://securitylab.github.com/advisories/GHSL-2022-131_owslib/
- https://www.debian.org/security/2023/dsa-5426