<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for python-djangorestframework</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2021:0338-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2021-02-25T09:05:18Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-02-25T09:05:18Z</InitialReleaseDate>
    <CurrentReleaseDate>2021-02-25T09:05:18Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for python-djangorestframework</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for python-djangorestframework fixes the following issues:

Update to 3.11.2

* Security: Drop urlize_quoted_links template tag in favour of 
  Django's built-in urlize. Removes a XSS vulnerability for some 
  kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)
* update Django for APIs book to 3.0 edition
* decode base64 credentials as utf8; adjust tests
* Remove compat urls for Django &lt; 2.0

This update was imported from the openSUSE:Leap:15.2:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2021-338</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NYNAEPY3UVCIEUTPMQBXFJ42XJG7RVG/</URL>
      <Description>E-Mail link for openSUSE-SU-2021:0338-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1177205</URL>
      <Description>SUSE Bug 1177205</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-25626/</URL>
      <Description>SUSE CVE CVE-2020-25626 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP2">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP2">
        <FullProductName ProductID="SUSE Package Hub 15 SP2">SUSE Package Hub 15 SP2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="python3-djangorestframework-3.11.2-bp152.2.3.1">
      <FullProductName ProductID="python3-djangorestframework-3.11.2-bp152.2.3.1">python3-djangorestframework-3.11.2-bp152.2.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="python3-djangorestframework-3.11.2-bp152.2.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP2">
      <FullProductName ProductID="SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1">python3-djangorestframework-3.11.2-bp152.2.3.1 as a component of SUSE Package Hub 15 SP2</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious &lt;script&gt; tags, leading to a cross-site-scripting (XSS) vulnerability.</Note>
    </Notes>
    <CVE>CVE-2020-25626</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NYNAEPY3UVCIEUTPMQBXFJ42XJG7RVG/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-25626.html</URL>
        <Description>CVE-2020-25626</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1177205</URL>
        <Description>SUSE Bug 1177205</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
