OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8247-1 advisory.

    It was discovered that OWSLib did not properly disable entity resolution within its XML parser. An     attacker could possibly use this issue to read arbitrary files via a crafted XML payload.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service
    interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and
    `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-
    controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in
    version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library
    manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3470 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3470-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 25, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : owslib     Version        : 0.17.1-1+deb10u1     CVE ID         : CVE-2023-27476     Debian Bug     : 1034182

    In OWSLib, a Python client library for Open Geospatial web services,     the XML parser did not disable entity resolution which could lead to     arbitrary file reads from an attacker-controlled XML payload.

    For Debian 10 buster, this problem has been fixed in version     0.17.1-1+deb10u1.

    We recommend that you upgrade your owslib packages.

    For the detailed security status of owslib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/owslib

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5426 advisory.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e5d117b3-2153-4129-81ed-42b0221afa78 advisory.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ae06b3704c advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8312a80917 advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9a878398a6 advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
314218	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : OWSLib vulnerability (USN-8247-1)	Nessus	Ubuntu Local Security Checks	Local	high
251047	Linux Distros Unpatched Vulnerability : CVE-2023-27476	Nessus	Misc.	Local	high
412698	SCA: security update for OWSLib (GHSA-8h9c-r582-mggc)	Tenable Cloud Security	SCA Checks	Local	high
412698	SCA: security update for OWSLib (GHSA-8h9c-r582-mggc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
177612	Debian dla-3470 : owslib-doc - security update	Nessus	Debian Local Security Checks	Local	high
177305	Debian DSA-5426-1 : owslib - security update	Nessus	Debian Local Security Checks	Local	high
174305	FreeBSD : py39-OWSLib -- arbitrary file read vulnerability (e5d117b3-2153-4129-81ed-42b0221afa78)	Nessus	FreeBSD Local Security Checks	Local	high
172667	Fedora 36 : mingw-python-OWSLib (2023-ae06b3704c)	Nessus	Fedora Local Security Checks	Local	high
172660	Fedora 37 : mingw-python-OWSLib (2023-8312a80917)	Nessus	Fedora Local Security Checks	Local	high
172484	Fedora 38 : mingw-python-OWSLib (2023-9a878398a6)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2023-27476

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high