{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-djangorestframework",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-djangorestframework fixes the following issues:\n\nUpdate to 3.11.2\n\n* Security: Drop urlize_quoted_links template tag in favour of \n  Django\u0027s built-in urlize. Removes a XSS vulnerability for some \n  kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)\n* update Django for APIs book to 3.0 edition\n* decode base64 credentials as utf8; adjust tests\n* Remove compat urls for Django \u003c 2.0\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-338",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0338-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0338-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NYNAEPY3UVCIEUTPMQBXFJ42XJG7RVG/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0338-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NYNAEPY3UVCIEUTPMQBXFJ42XJG7RVG/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1177205",
        "url": "https://bugzilla.suse.com/1177205"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25626 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25626/"
      }
    ],
    "title": "Security update for python-djangorestframework",
    "tracking": {
      "current_release_date": "2021-02-25T09:05:18Z",
      "generator": {
        "date": "2021-02-25T09:05:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0338-1",
      "initial_release_date": "2021-02-25T09:05:18Z",
      "revision_history": [
        {
          "date": "2021-02-25T09:05:18Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-djangorestframework-3.11.2-bp152.2.3.1.noarch",
                "product": {
                  "name": "python3-djangorestframework-3.11.2-bp152.2.3.1.noarch",
                  "product_id": "python3-djangorestframework-3.11.2-bp152.2.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP2",
                "product": {
                  "name": "SUSE Package Hub 15 SP2",
                  "product_id": "SUSE Package Hub 15 SP2"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-djangorestframework-3.11.2-bp152.2.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1.noarch"
        },
        "product_reference": "python3-djangorestframework-3.11.2-bp152.2.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-25626",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25626"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25626",
          "url": "https://www.suse.com/security/cve/CVE-2020-25626"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1177205 for CVE-2020-25626",
          "url": "https://bugzilla.suse.com/1177205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:python3-djangorestframework-3.11.2-bp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-02-25T09:05:18Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-25626"
    }
  ]
}