GHSA-p9wf-3xpg-c9g5

XML External Entity Injection in PyWPS

Source: GitHub Advisory Database (reviewed) High CVE-2021-39371

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pywps	< 4.5.0	4.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-39371 advisory
https://github.com/geopython/OWSLib/issues/790 web
https://github.com/geopython/pywps/pull/616 web
https://github.com/geopython/pywps/commit/7d6b26a2e931df2feca0b7fb24f4d01610825aee web
https://github.com/advisories/GHSA-p9wf-3xpg-c9g5 advisory
https://github.com/geopython/pywps package
https://github.com/pypa/advisory-database/tree/main/vulns/pywps/PYSEC-2021-121.yaml web
https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html web