CVE catalog

CVE-2023-27476

owslib: CVE-2023-27476

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.98% · Oct 25, 2026

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianowslibsid0.36.0-1fixed
Debianowslibforky0.36.0-1fixed
Debianowslibtrixie0.33.0-1fixed
Debianowslibbookworm0.27.2-3fixed
Ubuntuowslibpro0.23.0-1vulnerable
Ubuntuowslibpro0.25.0-1vulnerable
Ubuntuowslibpro0.25.0-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianowslibsourcesid0.27.2-3not yet assignedNot reported[1034182]
Debianowslibsourceforky0.27.2-3not yet assignedNot reported[1034182]
Debianowslibsourcetrixie0.27.2-3not yet assignedNot reported[1034182]
Debianowslibsourcebookworm0.27.2-3not yet assignedNot reported[1034182]
Ubuntuowslibdebpro0.25.0-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-27476Not reported

[Debian bug #1034182]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]