-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 29 Sep 2026 12:29:58 -0700 Source: python-django Architecture: source Version: 3:3.2.25-0+deb12u5 Distribution: bookworm-security Urgency: high Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Closes: 1138775 1141629 Changes: python-django (3:3.2.25-0+deb12u5) bookworm-security; urgency=high . * Non-maintainer upload by the LTS security team. * CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header. django.middleware.cache.UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header failed to strip that whitespace, a response with a "Vary: * " header (note the trailing space) was not recognized as containing the wildcard, causing it to be stored and potentially served from the cache when it should not have been. (Closes: #1138775) * CVE-2026-48588: UpdateCacheMiddleware and the @cache_page decorator cached responses that vary on cookies when the incoming request carried unrelated cookies, which allowed remote attackers to read private data from the shared cache. (Closes: #1141629) Checksums-Sha1: c7c0b17bcd6e330e7ae1bf90f6f977880294691c 2837 python-django_3.2.25-0+deb12u5.dsc a706db3607e3cc567ea4a172589f1360a614a6c6 9836336 python-django_3.2.25.orig.tar.gz 84e1ecef4fbcd644ecde25bdc63d9802929309c0 70568 python-django_3.2.25-0+deb12u5.debian.tar.xz 2a5ca39e54f4f000acd3cfeb5b5819c7d9a7a218 7911 python-django_3.2.25-0+deb12u5_source.buildinfo Checksums-Sha256: e434dd6f1b98c07a8fd374d425522e2c31de4de3292a96c836381e841ce35dca 2837 python-django_3.2.25-0+deb12u5.dsc 7ca38a78654aee72378594d63e51636c04b8e28574f5505dff630895b5472777 9836336 python-django_3.2.25.orig.tar.gz bf119c85d6ac55ff110905c70e7b73921f16bd0a2da564a1060ea0bc76f3b2f7 70568 python-django_3.2.25-0+deb12u5.debian.tar.xz 5a19fc8e6cc07ae233d4ec2f9045efd646b3c4d63a728fb2d0ca765a97e22ba7 7911 python-django_3.2.25-0+deb12u5_source.buildinfo Files: 89b34d41538f898de03c81c026ab5f75 2837 python optional python-django_3.2.25-0+deb12u5.dsc a16a8c39121acf9a84433bf0c616d575 9836336 python optional python-django_3.2.25.orig.tar.gz 3d6735500271b0904bf7f4e27be5e33b 70568 python optional python-django_3.2.25-0+deb12u5.debian.tar.xz 52a3eda1d0519c698359ba3f5beeee4b 7911 python optional python-django_3.2.25-0+deb12u5_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmq9J98ACgkQHpU+J9Qx HlgktBAAt3eShNk/qjKgAKHVlANpfvlQdyUlwAv8OKdW2qQczEuG7FwSlUg6ChMD SoWbPnqe1MA7o+SZRyG/r/r4eyqoyBqzzEbU/v+LruDz9+tvtBESizG9oMZkFr02 rGpdg9ztbZHP1YTy2iIXxYnPblq4ddIZrRWWDEs/E8c+wcrephD+XgmBG5/bRYrw QegYOkmKRfHhpnn7pY44oQOkIy7UdiZTgbBfGecEe0UWudpgv9+pBZEznjAZDIRa NwQ1kgc0wv2ws3/8ioasEY+KKr/XxGkLZ1P4K7ApUK+OIp1N/rl/o80W3UwVH6qK CWlDerQLXUSn2tEtjsAWcshl7A5RTeolpg+xRHUfBJ3UxfAcLRGTYd6EwOI84ME6 ptfWJSFTkwa3Y+uaIMi1eQlAh3jUm62JWU7NfIUKR05Yj03fqIFs4OaEcPBEXONp tF4Zg7aPY5D7Ilcj8u/1Lhv+oCQGvz8Ttww0yM8g0iL8NCCXTgZh4MMAlr7JsxL/ vxvcrED11TJj363Sl8TzpaWjTlXhAwqRNtt3OPqdvF1IA2StHnW1Fo4qlWP/1ZA6 gpIyRk88bD7yf8powAaUvtuSYyOGqGx6UYLjd6V6QsgP+CGI0wUGUtxvFSfymH6l 9JvcOtvMfBsx7b1P0JFwBDw0UfN7QennqySowTgywVeCVoa5PHE= =1Noy -----END PGP SIGNATURE-----
