PT-2021-22571 · Owslib+2 · Owslib+2

Cheginit · Published 2021-08-23 · Updated 2022-06-02 · CVE-2021-39371

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: PyWPS versions prior to 4.5.0 OWSLib version 0.24.1

Description: An XML external entity (XXE) injection allows an attacker to view files on the application server filesystem by assigning a path to the entity.

Recommendations: For PyWPS versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. For OWSLib version 0.24.1, consider disabling the XML external entity parsing functionality as a temporary workaround until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

CWE-91

Related Identifiers

CVE-2021-39371

DLA-2754-1

GHSA-P9WF-3XPG-C9G5

PYSEC-2021-121

Affected Products

Debian

Owslib

Pywps

References · 20

• https://github.com/geopython/OWSLib/issues/790 · Patch
• https://github.com/geopython/pywps/pull/616 · Patch
• https://osv.dev/vulnerability/GHSA-p9wf-3xpg-c9g5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39371 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-39371 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39371 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39371 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39371 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2754-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39371 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pywps/PYSEC-2021-121.yaml · Note
• https://github.com/geopython/pywps/commit/7d6b26a2e931df2feca0b7fb24f4d01610825aee · Note
• https://github.com/geopython/pywps · Note