Invalid XML security version
- Dominant language
- Python
- Stars
- 186
- Forks
- 117
- Avg merge
- 11d 20h
- Merged PRs (30d)
- 1
Description
# Description
Since the introduction of #621 and release `4.5.0` in #613, tools that track security/dependency updates like `pyup` are flagging the following:
```
An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected. See CVE-2021-39371.
```
from:
https://pyup.io/repos/github/crim-ca/weaver/commits/?page=1#a586cb79de278fdc33d6eeee5feb6f6233f60a16
Because XML security specific to that issue was handled in #618, which is tagged after in `4.4.5`, the requirement should be `injection in PyWPS before 4.4.5`, an mark the minimum requirement as `4.4.5` rather than `4.5.0`.
I would like to have a revision of the security advisory for the lower version for 2 reasons:
1. Version `4.5.0` introduces some important changes relative to `ogc-api`, which are not trivial to guarantee backward compatibility with existing services that did not expect them to be there.
2. According to whichever decision taken from #590, the `4.5.x` branch should be either a development branch until `4.6.x` or addition of `ogc-api` should introduce `5.x` releases. Either way, `4.5.0` is not a "ready" release (as shown by tests still failing), and suggesting users to fix the XML security should not be done at the same time as new features integration.
Currently, I am receiving a lot of warnings regarding this security issue, and I cannot directly/safely update to `4.5.0` yet until it is properly validated.
Contributor guide
Assessment
This issue has not been assessed yet.