Bug 1878635 (CVE-2020-25626)

Summary:	CVE-2020-25626 django-rest-framework: XSS Vulnerability in API viewer
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cmeyers, cmoore, fcanogab, gblomqui, gmainwar, hvyas, kaycoth, lnacshon, mabashia, notting, rpetrell, security-response-team, smcdonal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	django-rest-framework 3.12.0, django-rest-framework 3.11.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Django REST Framework. When using the browseable API viewer, the Django REST Framework fails to properly escape certain strings that come from user input. This flaw allows a user to control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-30 20:21:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1878709, 1878710, 1878711, 1878712, 1879392, 1879393
Bug Blocks:	1877552

Description Borja Tarraso 2020-09-14 08:52:40 UTC

A flaw was found in Django REST Framework. When using the browseable API viewer, DRF fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

Comment 6 Borja Tarraso 2020-09-17 06:54:07 UTC

Acknowledgments:

Name: Lior Ethan (Red Hat), Ryan Petrello (Red Hat)

Comment 11 errata-xmlrpc 2020-09-30 14:13:27 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:4136 https://access.redhat.com/errata/RHSA-2020:4136

Comment 12 errata-xmlrpc 2020-09-30 14:14:52 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.6 for RHEL 7

Via RHSA-2020:4137 https://access.redhat.com/errata/RHSA-2020:4137

Comment 13 Product Security DevOps Team 2020-09-30 20:21:41 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25626

Comment 14 RaTasha Tillery-Smith 2020-12-15 16:06:04 UTC

Statement:

In Red Hat Ceph Storage 2, python-djangorestframework is embedded in calamari-server. However, calamari-server is no longer supported and will not be fixed.