Debian alert DLA-4802-1 (python-django)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4802-1] python-django security update
Date:
             
 
Wed, 30 Sep 2026 11:59:43 -0400
Message-ID:
             
 
<179078395720.2887660.2233574385263013074@bigcat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4802-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
September 29, 2026                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : python-django
Version        : 3:3.2.25-0+deb12u5
CVE ID         : CVE-2026-48587 CVE-2026-48588
Debian Bug     : 1138775 1141629

Multiple vulnerabilities were discovered in Django, the Python-based
web development framework:

CVE-2026-48587

    Potential exposure of private data via whitespace padding in Vary
    header. django.middleware.cache.UpdateCacheMiddleware incorrectly
    cached responses whose Vary header values contained leading or
    trailing whitespace. Because has_vary_header failed to strip that
    whitespace, a response with a "Vary: * " header (note the
    trailing space) was not recognized as containing the wildcard,
    causing it to be stored and potentially served from the cache
    when it should not have been.

CVE-2026-48588

    UpdateCacheMiddleware and the @cache_page decorator cached
    responses that vary on cookies when the incoming request carried
    unrelated cookies, which allowed remote attackers to read private
    data from the shared cache.

For Debian 12 bookworm, these problems have been fixed in version
3:3.2.25-0+deb12u5.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-django

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmq9MdIACgkQHpU+J9Qx
HlggIBAAsQP3FFEHTW9YCtFKsNRqxUQrV9ED7wzV4vGCAw8j/SZd7/KLXkRyvpmK
MC2BVHE6/17hWkFEwZJq/5rH6gZglS7aCNkUsnY1XjGs44O8T0vED1ZXmjPhq3Tl
32+uJqteRpfXlI5VfnWiL6AMyJ0dgNyOdZBq1snVJs4x5rCzORG2wjfebCVwb7pE
MaFoHJKuddt02tUgeg8TrDv10aM3ChSrZYvTG9bJCCwZPapL8r0eaIko8nzLLwsl
PTKM3GAXfdgvUJNO/7l0KCS/g6wuGJbDGmfG3bGSQ3CFcoAs9cFOfzdJxN+ieWqi
33eiuUIzey23okDzQXd3iXqXOFdvDFxipPQgAn3nR2zPUO2RZwCasp+7VAGAYLZo
flXZzY2Ld3sYj/cbXywhi+sVDFvYG68ooo4klONKENFpm5BFq79tGIKqekDJpmUk
CDxodpPdD1OVlkebPp63oWXq7shGUP5RnEtEbX+2TA89AvUhcgOEVkQ9h0h3iXQQ
tpBKNUT10tRhmTpDt8SVJxBEmNYWtpJIW9zMMjppkj32Hvbvm0rr4ebUowcEo2lJ
qsNiKlqGDk2v8M/V3yfsRfZEwx2Sl40xqsozDrbBZZ81uIQQ5CQaTuGn0jVcelTQ
MxTGi55DHAjccOeZOCQ9BEiybeT5qWaFKPFmz/Y5ibTnuc+160s=
=w7pD
-----END PGP SIGNATURE-----