PT-2023-21153 · Owslib+4 · Owslib+4
Jorgectf
+1
·
Publicado
2023-03-07
·
Atualizado
2026-05-07
·
CVE-2023-27476
CVSS v4.0
8.8
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OWSLib versions prior to 0.28.1
Description
The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. The estimated number of potentially affected devices is not specified.
Recommendations
For versions prior to 0.28.1, upgrade to version 0.28.1 to resolve the issue.
As a temporary workaround, consider patching the library manually by setting
resolve entities=False in lxml's parser or applying the provided patch to disable entity resolution for xml.etree.
Restrict access to the XML parsing functionality to minimize the risk of exploitation until the issue is resolved.Exploit
Correção
XXE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Linuxmint
Owslib
Ubuntu
Lxml
Xml.Etree