Lucene search
Veracode Vulnerability DatabaseVERACODE:39603HistoryMar 09, 2023 - 9:37 a.m.
XML External Entity (XXE)
2023-03-0909:37:09
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
xml external entity
vulnerability
owslib
lxml
entity resolution
arbitrary files
crafted xml document
security
0.001 Low
EPSS
Percentile
51.0%
owslib is vulnerable to XML External Entity (XXE). The vulnerability is due to allowing lxml entity resolution, which allows an attacker to read arbitrary files by parsing a crafted XML document.
References
github.com/advisories/GHSA-8h9c-r582-mggc
github.com/geopython/OWSLib/commit/b0c687544ddc213d8dcd4a056139b63451938b21
github.com/geopython/OWSLib/pull/863
github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f
github.com/geopython/OWSLib/releases/tag/0.28.1
github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc
lists.debian.org/debian-lts-announce/2023/06/msg00032.html
securitylab.github.com/advisories/GHSL-2022-131_owslib/
www.debian.org/security/2023/dsa-5426
Related
debiancve
debiancve
CVE-2023-27476
2023-03-08 00:15:08
ubuntucve
ubuntucve
CVE-2023-27476
2023-03-08 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: mingw-python-OWSLib-0.28.1-1.fc36
2023-03-18 05:04:28
[SECURITY] Fedora 38 Update: mingw-python-OWSLib-0.28.1-1.fc38
2023-03-13 00:20:49
[SECURITY] Fedora 37 Update: mingw-python-OWSLib-0.28.1-1.fc37
2023-03-18 05:01:15
debian
debian
[SECURITY] [DLA 3470-1] owslib security update
2023-06-25 18:34:53
[SECURITY] [DSA 5426-1] owslib security update
2023-06-14 02:25:54
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0112)
2023-03-28 00:00:00
Fedora: Security Advisory for mingw-python-OWSLib (FEDORA-2023-ae06b3704c)
2023-03-19 00:00:00
Fedora: Security Advisory for mingw-python-OWSLib (FEDORA-2023-8312a80917)
2023-03-19 00:00:00
nvd
nvd
CVE-2023-27476
2023-03-08 00:15:08
github
github
OWSLib vulnerable to XML External Entity (XXE) Injection
2023-03-07 20:41:36
osv
osv
owslib - security update
2023-06-14 00:00:00
CVE-2023-27476
2023-03-08 00:15:08
OWSLib vulnerable to XML External Entity (XXE) Injection
2023-03-07 20:41:36
nessus
nessus
Debian DLA-3470-1 : owslib - LTS security update
2023-06-25 00:00:00
Fedora 36 : mingw-python-OWSLib (2023-ae06b3704c)
2023-03-18 00:00:00
Fedora 37 : mingw-python-OWSLib (2023-8312a80917)
2023-03-18 00:00:00
cvelist
cvelist
CVE-2023-27476 XML External Entity (XXE) Injection in OWSLib
2023-03-07 23:20:32
freebsd
freebsd
py39-OWSLib -- arbitrary file read vulnerability
2023-03-07 00:00:00
cve
cve
CVE-2023-27476
2023-03-08 00:15:08
mageia
mageia
Updated python-owslib packages fix security vulnerability
2023-03-24 08:55:49
prion
prion
Design/Logic Flaw
2023-03-08 00:15:00