Ubuntu alert USN-8247-1 (owslib)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8247-1] OWSLib vulnerability
Date:
             
 
Thu, 07 May 2026 13:17:47 +0000
Message-ID:
             
 
<E1wKybr-0000Ua-Js@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8247-1
May 07, 2026

owslib vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

OWSLib could be made to expose sensitive information.

Software Description:
- owslib: Client library for Open Geospatial (OGC) web services

Details:

It was discovered that OWSLib did not properly disable entity resolution
within its XML parser. An attacker could possibly use this issue to read
arbitrary files via a crafted XML payload.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  python3-owslib                  0.25.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  python3-owslib                  0.19.1-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  python-owslib                   0.16.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  python3-owslib                  0.16.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  python-owslib                   0.10.3-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  python3-owslib                  0.10.3-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8247-1
  CVE-2023-27476


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmn8j2gACgkQcpJm3tlz
hgEo+A/+KPZkgfORch+mlpNG7gHe4bGWO3MfpaQfPOEGoga5hdQuN1fLVSlthlyi
Rbk9ORPWFv9dA+0JF5Ql1QWMBZtQKNJrYb2gNN2M6IYZonW3qy1BcHjzNjMIYiEX
wY1PBOljdURT0gAn1ubyjTxUTTpGxlM7vxsZssJaC8Z0Php2+tPucU5kq3HxKfMZ
qOeWzDIdJEUG395CUg5gC4t5DH8R1q0m7XvyKMD+HsL1umyt2yR5I61TJeNM4mYz
TskiGK5BDNjvDfcajkLlMrpdqPELG+6LdKeMsDTBshczx5IzAvgGnt+jsuF12R7u
QeE1dhJZx5+KjEMeVcOckF4VEC66PMFQvC48Xxi/A74xbZ5sKTnxcHnRzzPFC8I3
BX0OCqdiHl5JChmSUHGKQ/WmFlhH5u0090SUaU4l+A0SwEAD35zltT3XyHR/rSXl
e0OIPewXWPsrU0GrJ2V1CjhIserce3hSRkvwg+r2v9EQL7iJH8dBqgI84ECpLc5G
dIOjdLZ3i476Jj5f3rNdOFaCQJWaOsDxWOpL0NNmPjr8LOe6Lhm8HN02ORn8wz2C
7WlcUReg3eZZIdp++e6VF7uJ7UCjrb+ZjNF5HJzyQQcOhzpXizCxeLhg0t4Lb1lL
7/N/3YfbECPYs9qCHao+DdmkzCfZybfzSJPRsdPfUISdzNkVtJc=
=5A4l
-----END PGP SIGNATURE-----