{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-djangorestframework",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-djangorestframework fixes the following issues:\n\nUpdate to 3.11.2\n\n* Security: Drop urlize_quoted_links template tag in favour of \n  Django\u0027s built-in urlize. Removes a XSS vulnerability for some \n  kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)\n* update Django for APIs book to 3.0 edition\n* decode base64 credentials as utf8; adjust tests\n* Remove compat urls for Django \u003c 2.0\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-322",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0322-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0322-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R3GZDKNNVOILNHAK6KSWOYM6URRERTB4/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0322-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R3GZDKNNVOILNHAK6KSWOYM6URRERTB4/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177205",
        "url": "https://bugzilla.suse.com/1177205"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25626 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25626/"
      }
    ],
    "title": "Security update for python-djangorestframework",
    "tracking": {
      "current_release_date": "2021-02-21T22:33:07Z",
      "generator": {
        "date": "2021-02-21T22:33:07Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0322-1",
      "initial_release_date": "2021-02-21T22:33:07Z",
      "revision_history": [
        {
          "date": "2021-02-21T22:33:07Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-djangorestframework-3.11.2-lp152.2.3.1.noarch",
                "product": {
                  "name": "python3-djangorestframework-3.11.2-lp152.2.3.1.noarch",
                  "product_id": "python3-djangorestframework-3.11.2-lp152.2.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-djangorestframework-3.11.2-lp152.2.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:python3-djangorestframework-3.11.2-lp152.2.3.1.noarch"
        },
        "product_reference": "python3-djangorestframework-3.11.2-lp152.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25626",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25626"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:python3-djangorestframework-3.11.2-lp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25626",
          "url": "https://www.suse.com/security/cve/CVE-2020-25626"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177205 for CVE-2020-25626",
          "url": "https://bugzilla.suse.com/1177205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:python3-djangorestframework-3.11.2-lp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:python3-djangorestframework-3.11.2-lp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-02-21T22:33:07Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-25626"
    }
  ]
}