djangorestframework: CVE-2020-25626

Debian Bug report logs - #971554
djangorestframework: CVE-2020-25626

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: djangorestframework: CVE-2020-25626

Date: Thu, 01 Oct 2020 20:43:55 +0200

Source: djangorestframework
Version: 3.11.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for djangorestframework.

CVE-2020-25626[0]:
| A flaw was found in Django REST Framework versions before 3.12.0 and
| before 3.11.2. When using the browseable API viewer, Django REST
| Framework fails to properly escape certain strings that can come from
| user input. This allows a user who can control those strings to inject
| malicious &lt;script&gt; tags, leading to a cross-site-scripting (XSS)
| vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-25626
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25626
[1] https://github.com/encode/django-rest-framework/commit/4121b01b912668c049b26194a9a107c27a332429

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.