OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. GitHub Security Advisory: https://github.com/geopython/OWSLib/security/advisories/GHSA-8h9c-r582-mggc Upstream fix: https://github.com/geopython/OWSLib/pull/863/commits/b92687702be9576c0681bb11cad21eb631b9122f
Created mingw-python-OWSLib tracking bugs for this issue: Affects: fedora-all [bug 2176418] Created python-OWSLib tracking bugs for this issue: Affects: epel-all [bug 2176417] Affects: fedora-all [bug 2176419]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.