[SECURITY] [DLA 4802-1] python-django security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4802-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
September 29, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : python-django
Version : 3:3.2.25-0+deb12u5
CVE ID : CVE-2026-48587 CVE-2026-48588
Debian Bug : 1138775 1141629
Multiple vulnerabilities were discovered in Django, the Python-based
web development framework:
CVE-2026-48587
Potential exposure of private data via whitespace padding in Vary
header. django.middleware.cache.UpdateCacheMiddleware incorrectly
cached responses whose Vary header values contained leading or
trailing whitespace. Because has_vary_header failed to strip that
whitespace, a response with a "Vary: * " header (note the
trailing space) was not recognized as containing the wildcard,
causing it to be stored and potentially served from the cache
when it should not have been.
CVE-2026-48588
UpdateCacheMiddleware and the @cache_page decorator cached
responses that vary on cookies when the incoming request carried
unrelated cookies, which allowed remote attackers to read private
data from the shared cache.
For Debian 12 bookworm, these problems have been fixed in version
3:3.2.25-0+deb12u5.
We recommend that you upgrade your python-django packages.
For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmq9MdIACgkQHpU+J9Qx
HlggIBAAsQP3FFEHTW9YCtFKsNRqxUQrV9ED7wzV4vGCAw8j/SZd7/KLXkRyvpmK
MC2BVHE6/17hWkFEwZJq/5rH6gZglS7aCNkUsnY1XjGs44O8T0vED1ZXmjPhq3Tl
32+uJqteRpfXlI5VfnWiL6AMyJ0dgNyOdZBq1snVJs4x5rCzORG2wjfebCVwb7pE
MaFoHJKuddt02tUgeg8TrDv10aM3ChSrZYvTG9bJCCwZPapL8r0eaIko8nzLLwsl
PTKM3GAXfdgvUJNO/7l0KCS/g6wuGJbDGmfG3bGSQ3CFcoAs9cFOfzdJxN+ieWqi
33eiuUIzey23okDzQXd3iXqXOFdvDFxipPQgAn3nR2zPUO2RZwCasp+7VAGAYLZo
flXZzY2Ld3sYj/cbXywhi+sVDFvYG68ooo4klONKENFpm5BFq79tGIKqekDJpmUk
CDxodpPdD1OVlkebPp63oWXq7shGUP5RnEtEbX+2TA89AvUhcgOEVkQ9h0h3iXQQ
tpBKNUT10tRhmTpDt8SVJxBEmNYWtpJIW9zMMjppkj32Hvbvm0rr4ebUowcEo2lJ
qsNiKlqGDk2v8M/V3yfsRfZEwx2Sl40xqsozDrbBZZ81uIQQ5CQaTuGn0jVcelTQ
MxTGi55DHAjccOeZOCQ9BEiybeT5qWaFKPFmz/Y5ibTnuc+160s=
=w7pD
-----END PGP SIGNATURE-----
Reply to: