| Package | Affected versions | Patched versions |
|---|---|---|
| owslib | < 0.28.1 | 0.28.1 |
| owslib | < 0.28.1 | 0.28.1 |
OWSLib's XML parser (which supports both lxml and xml.etree) does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.
resolve_entities=False to lxml's parser: https://github.com/geopython/OWSLib/pull/863patch_well_known_namespaces(etree)
etree.set_default_parser(
parser=etree.XMLParser(resolve_entities=False)
)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free