CVE-2023-27476

Advisory

Datacube-ows version 1.8.37 has upgraded its owslib dependency to versions greater than 0.29.2, moving from previous versions below 0.28.1
https://github.com/opendatacube/datacube-ows/pull/973/commits/e7403ce5cccdbcc2d7b231679bb9b98bfbaa7ceb

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------

Maintenance release. Security updates and bug fixes around timezone handling.

* Fixes to timezone handling (958, 982)
* Various Github CI improvements (959, 972, 974)
* Automatic dependency updates (966, 970, 971, 975, 976, 977, 980, 981, 984, 986, 988, 991, 992)
* Update dependencies to block upstream security issues (973)
* Label Prometheus metrics by endpoint, not path (978)
* Update base docker image and remove docker efficiency analysis GHA (990)
* Update HISTORY.rst and increment default version for release (993)

Contributions from benjimin, pjonsson, SpacemanPaul and dependabot.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27476