PYSEC-2023-86
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/owslib/PYSEC-2023-86.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2023-86
- Aliases
- Published
- 2023-03-08T00:15:00Z
- Modified
- 2026-02-20T12:57:34.587865Z
- Summary
- [none]
- Details
-
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both
lxmlandxml.etree) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. SeeGHSA-8h9c-r582-mggcfor details. - References
Affected packages
PyPI / owslib
Package
- Name
- owslib
- View open source insights on deps.dev
- Purl
- pkg:pypi/owslib
Affected ranges
- Type
- GIT
- Repo
- https://github.com/geopython/OWSLib
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.28.1
Affected versions
0.*
0.1.0
0.2.0
0.2.1
0.3
0.3.1
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.8.10
0.8.11
0.8.12
0.8.13
0.9.0
0.9.1
0.9.2
0.10.0
0.10.1
0.10.2
0.10.3
0.11.0
0.11.1
0.11.2
0.12.0
0.13.0
0.14.0
0.15.0
0.16.0
0.17.0
0.17.1
0.18.0
0.19.0
0.19.1
0.19.2
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.26.0
0.27.0
0.27.1
0.27.2
0.28.0