—

PYSEC-2021-121

Quick fix

PYSEC-2021-121 — pywps: upgrade to the fixed version with the command below.

pip install --upgrade 'pywps>=4.5.0'

Details

An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pywps

Introduced in: 0Fixed in: 4.5.0

Fixpip install --upgrade 'pywps>=4.5.0'

References

https://github.com/geopython/pywps/pull/616[WEB]
https://github.com/geopython/OWSLib/issues/790[REPORT]
https://github.com/advisories/GHSA-p9wf-3xpg-c9g5[ADVISORY]