CVE-2023-27476

Name	CVE-2023-27476
Description	OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3470-1, DSA-5426-1
Debian Bugs	1034182

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
owslib (PTS)	buster	0.17.1-1	vulnerable
	buster (security)	0.17.1-1+deb10u1	fixed
	bullseye	0.23.0-1	vulnerable
	bullseye (security)	0.23.0-1+deb11u1	fixed
	bookworm	0.27.2-3	fixed
	sid, trixie	0.29.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
owslib	source	experimental	0.28.1-1~exp1
owslib	source	buster	0.17.1-1+deb10u1	DLA-3470-1
owslib	source	bullseye	0.23.0-1+deb11u1	DSA-5426-1
owslib	source	(unstable)	0.27.2-3		1034182

Notes

https://github.com/geopython/OWSLib/commit/d91267303a695d69e73fa71efa100a035852a063 (0.29.0)
https://github.com/geopython/OWSLib/commit/b0c687544ddc213d8dcd4a056139b63451938b21 (0.28.1)
https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc
https://securitylab.github.com/advisories/GHSL-2022-131_OWSLib/