Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0322-1

Опубликовано: 21 фев. 2021
Источник: suse-cvrf

Описание

Security update for python-djangorestframework

This update for python-djangorestframework fixes the following issues:

Update to 3.11.2

  • Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)
  • update Django for APIs book to 3.0 edition
  • decode base64 credentials as utf8; adjust tests
  • Remove compat urls for Django < 2.0

Список пакетов

openSUSE Leap 15.2
python3-djangorestframework-3.11.2-lp152.2.3.1

Ссылки

Описание

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

Затронутые продукты
openSUSE Leap 15.2:python3-djangorestframework-3.11.2-lp152.2.3.1
Ссылки