Debian DSA-5186-1 : djangorestframework - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5186 advisory. Two cross-site scripting vulnerabilities were discovered in the Django Rest Framework, a toolkit to build web APIs. For the oldstable distribution buster, this problem has...

openSUSE: Security Advisory for python-djangorestframework (openSUSE-SU-2021:0322-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

bower-cache (0.5.0), django-bird-colony (0.11.1) +6 more potentially affected by CVE-2020-25626 via djangorestframework (2.4.8)

djangorestframework PYPI version 2.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - bower-cache 0.5.0 - django-bird-colony 0.11.1 - django-bower-cache 0.5.0 - django-tour =0.6.2, =0.0.2, =1.1.0, =0.0.1,...

acp-calendar (1.6.0), aimmo (>=0.19.0b3974, <=0.61.8b52) +255 more potentially affected by CVE-2020-25626 via djangorestframework (>=3.1.1, <=3.11.1)

djangorestframework PYPI version =3.1.1, =0.19.0b3974, =2018.3.1, =0.1.0, =1.0.2, =3.5.34, =0.0.1, =0.0.1, =5.2.1, =4.0.0, =0.1.0, =1.1.1, =1.4.0rc1, =0.3.1, =0.8.1 and more Source cves: CVE-2020-25626 Source advisory: OSV:GHSA-FX83-3PH3-9J2Q...

acp-calendar (1.6.0), aimmo (>=0.19.0b3974, <=0.61.8b52) +255 more potentially affected by CVE-2020-25626 via djangorestframework (>=3.1.1, <=3.11.1)

djangorestframework PYPI version =3.1.1, =0.19.0b3974, =2018.3.1, =0.1.0, =1.0.2, =3.5.34, =0.0.1, =0.0.1, =5.2.1, =4.0.0, =0.1.0, =1.1.1, =1.4.0rc1, =0.3.1, =0.8.1 and more Source cves: CVE-2020-25626 Source advisory: GHSA-FX83-3PH3-9J2Q...

openSUSE Security Update : python-djangorestframework (openSUSE-2021-322)

This update for python-djangorestframework fixes the following issues : Update to 3.11.2 - Security: Drop urlizequotedlinks template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. boo1177205, CVE-2020-25626 - update Django fo...

Security update for python-djangorestframework (important)

openSUSE Security Update: Security update for python-djangorestframework Announcement ID: openSUSE-SU-2021:0322-1 Rating: important References: 1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 NVD : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 SUSE: 7.1...

salmon (0.2.0) potentially affected by CVE-2020-25626 via djangorestframework (2.3.9)

djangorestframework PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - salmon 0.2.0 Source cves: CVE-2020-25626 Source advisory: OSV:PYSEC-2020-263...

bower-cache (0.5.0), django-bird-colony (0.11.1) +6 more potentially affected by CVE-2020-25626 via djangorestframework (2.4.8)

djangorestframework PYPI version 2.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - bower-cache 0.5.0 - django-bird-colony 0.11.1 - django-bower-cache 0.5.0 - django-tour =0.6.2, =0.0.2, =1.1.0, =0.0.1,...

CVE-2020-25626

CVE-2020-25626 affects Django REST Framework (DRF) with versions prior to 3.12.0 and prior to 3.11.2. The flaw is an improper escape of certain user-controlled strings in the browseable API viewer, allowing injection of script tags (XSS). Impact is limited to cases where attackers can influence t...