OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3470 advisory.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5426 advisory.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e5d117b3-2153-4129-81ed-42b0221afa78 advisory.

  - OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service     interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and     `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-     controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in     version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library     manually. See `GHSA-8h9c-r582-mggc` for details. (CVE-2023-27476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ae06b3704c advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8312a80917 advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9a878398a6 advisory.

    Update to OWSLib-0.28.1, fixes CVE-2023-27476.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177612	Debian DLA-3470-1 : owslib - LTS security update	Nessus	Debian Local Security Checks	high
177305	Debian DSA-5426-1 : owslib - security update	Nessus	Debian Local Security Checks	high
174305	FreeBSD : py39-OWSLib -- arbitrary file read vulnerability (e5d117b3-2153-4129-81ed-42b0221afa78)	Nessus	FreeBSD Local Security Checks	high
172667	Fedora 36 : mingw-python-OWSLib (2023-ae06b3704c)	Nessus	Fedora Local Security Checks	high
172660	Fedora 37 : mingw-python-OWSLib (2023-8312a80917)	Nessus	Fedora Local Security Checks	high
172484	Fedora 38 : mingw-python-OWSLib (2023-9a878398a6)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-27476

high

Tenable Plugins

high

high

high

high

high

high