Ubuntu alert USN-8848-1 (python-django)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8848-1] Django vulnerabilities
Date:
             
 
Thu, 01 Oct 2026 08:07:51 +0000
Message-ID:
             
 
<E1xCBpX-00087F-FE@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8848-1
September 30, 2026

python-django vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Django.

Software Description:
- python-django: High-level Python web development framework

Details:

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial
lookups when processing untrusted input. A remote attacker could possibly
use this issue to make outbound network requests, write arbitrary files, or
execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)

Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly
cached requests where the Vary header contained an asterisk. A remote
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-6907)

Ahmed Badawe discovered that Django did not properly parse Cache-Control
response directives case-insensitively under certain circumstances. A
remote attacker could possibly use this issue to view sensitive information
from responses that were incorrectly cached. This issue only affected 
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-8404)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  python-django-doc               3:5.2.9-0ubuntu4.3
  python3-django                  3:5.2.9-0ubuntu4.3

Ubuntu 24.04 LTS
  python-django-doc               3:4.2.11-1ubuntu1.18
  python3-django                  3:4.2.11-1ubuntu1.18

Ubuntu 22.04 LTS
  python-django-doc               2:3.2.12-2ubuntu1.29
  python3-django                  2:3.2.12-2ubuntu1.29

Ubuntu 20.04 LTS
  python3-django                  2:2.2.12-1ubuntu0.29+esm10
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  python-django                   1:1.11.11-1ubuntu1.21+esm17
                                  Available with Ubuntu Pro
  python-django-common            1:1.11.11-1ubuntu1.21+esm17
                                  Available with Ubuntu Pro
  python3-django                  1:1.11.11-1ubuntu1.21+esm17
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  python-django                   1.8.7-1ubuntu5.15+esm13
                                  Available with Ubuntu Pro
  python-django-common            1.8.7-1ubuntu5.15+esm13
                                  Available with Ubuntu Pro
  python3-django                  1.8.7-1ubuntu5.15+esm13
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  python-django                   1.6.11-0ubuntu1.3+esm12
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8848-1
  CVE-2026-15307, CVE-2026-6907, CVE-2026-8404

Package Information:
  https://launchpad.net/ubuntu/+source/python-django/3:5.2....
  https://launchpad.net/ubuntu/+source/python-django/3:4.2....
  https://launchpad.net/ubuntu/+source/python-django/2:3.2....


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq+EGkACgkQcpJm3tlz
hgErqBAAhHVfXLOlwBgWO0kxZAcvt2yd7paN2ROM6W7yyKTGn5qeMAPBdXDDTOyF
B99GEJIqWLu/FS9NV4rcj6+KNWdAhAeBQdkMqyAAfTbYnVGcspZmqCljJ/nCTH8o
Mnmg94QNJBAzxOuUaYtwi/friO59J1SQ28Y+11cFKgoDZeIm30TN4enEpkId0p8n
aRdvzJrDfynL4crtBEIrYqg+itXAxFIVChEA7H+k9pDWA6GBrpgPTbyPCiqCw6WG
YfEjKDvfRAlceevHE75Bt0SxbihpmlLJ27swQdwm2ZKp1bcrH5c/SD8tJlYgwQqN
Y3ZNw2Bijwr+Rvzrxhciduc6Ke0Wj00ADKfZ3rA1mIT8/4XezZhz6zO/1/3SmGLg
lp6rYylM9xataUxI5Fr6QNTpzqCqPoQ4t8N0hFXatsAZFF07nTg0CdkTWSrhjflH
QSVWE+U/tQU4GG6XPGsoRdfPZoSMfol7yTHK1xcixXygMOWcggL1eukMlO/a2NF8
bWAw32y6AMSivykDJrfdiY98moKUMesQcKElWjLjBUE5L7M47Klxqf4SeYOJCQkA
fV0/2WoQj3JUUeolXvjrwkkPKNi/3Af1cpyWae/TiV55NKNf6iWRUFhOFDaanUXv
sGtfzKD4QKSZQpG8vm2idRft1U01LY/XJV1+/Y9LLR4oYxwz6Yg=
=wyuG
-----END PGP SIGNATURE-----