Critical XML Parsing Vulnerability in OWSLib: Arbitrary File Read Risk
Summary
CVE-2023-27476: OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. Affects owslib across 2 version ranges.
< 0.23.0-1+deb11u1
< 9530e923697badd5e5962e8f0243f3861150edd0
Fixed in 0.23.0-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OWSLib is a Python package designed for client programming with Open Geospatial Consortium (OGC) web service interface standards. It facilitates interaction with various OGC-compliant services, enabling users to access and manipulate geospatial data efficiently. The package supports XML parsing through libraries like lxml and xml.etree, which are essential for handling OGC web services. However, a significant vulnerability exists in its XML parser, which does not disable entity resolution, making it susceptible to attacks that can lead to arbitrary file reads from attacker-controlled XML payloads.
Vulnerability Detail
The vulnerability arises from OWSLib's XML parser failing to disable entity resolution. This oversight allows an attacker to craft a malicious XML payload that can exploit the parser, leading to unauthorized access to files on the server where the application is running. The implications of this vulnerability are severe, as it could expose sensitive information stored on the server, potentially leading to data breaches and further exploitation. The vulnerability affects all XML parsing operations within the OWSLib codebase, making it a critical issue that requires immediate attention.
How To Fix
Minimum fixed version
0.23.0-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade owslibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can manually patch the library to disable entity resolution in the XML parser. This involves modifying the XML parsing code to ensure that entity resolution is turned off. However, upgrading to the latest version is strongly recommended for a permanent solution.
Conclusion
The OWSLib package has a critical vulnerability in its XML parser that allows for arbitrary file reads due to entity resolution not being disabled. Users are strongly advised to upgrade to version 0.28.1 or later to mitigate this risk. Temporary workarounds exist, but they are not as effective as upgrading.
See every vulnerability recorded for owslib →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions prior to 0.28.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include unauthorized access to sensitive files on the server, leading to data breaches and further exploitation.
Yes, the only known workaround is to manually patch the library to disable entity resolution in the XML parser, but upgrading to the latest version is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for owslib.
