PT-2023-21153 · Owslib+4 · Owslib+4

Jorgectf + 1 · Published 2023-03-07 · Updated 2026-05-07 · CVE-2023-27476

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OWSLib versions prior to 0.28.1

Description The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 0.28.1, upgrade to version 0.28.1 to resolve the issue. As a temporary workaround, consider patching the library manually by setting resolve entities=False in lxml's parser or applying the provided patch to disable entity resolution for xml.etree. Restrict access to the XML parsing functionality to minimize the risk of exploitation until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-27476

DLA-3470-1

DSA-5426-1

GHSA-8H9C-R582-MGGC

MGASA-2023-0112

PYSEC-2023-86

USN-8247-1

Affected Products

Linuxmint

Owslib

Ubuntu

Lxml

Xml.Etree

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27476.json · Exploit
• https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f · Patch
• https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-27476 · Security Note
• https://ubuntu.com/security/CVE-2023-27476 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0112.html · Security Note
• https://osv.dev/vulnerability/DSA-5426-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/PYNYFUUI2JO56U35RT7DTZDQDCNCDAMH · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27476 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-27476 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8247-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0112 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-27476 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8247-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3470-1 · Vendor Advisory