OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1.
GitHub Security Advisory:
Created mingw-python-OWSLib tracking bugs for this issue:
Affects: fedora-all [bug 2176418]
Created python-OWSLib tracking bugs for this issue:
Affects: epel-all [bug 2176417]
Affects: fedora-all [bug 2176419]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.