SB2026103113 - Ubuntu update for python-django

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026103113

SB2026103113 - Ubuntu update for python-django

Published: October 31, 2026 Updated: November 8, 2026

Security Bulletin ID SB2026103113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-15307)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write files to disk or issue network requests as the Django process user.

The vulnerability exists due to improper input validation in spatial lookups when processing lookup values that are passed to GDALRaster. A remote user can supply a specially crafted lookup value to write files to disk or issue network requests as the Django process user.

The issue was reachable through the admin changelist for staff users with view permissions on any registered model containing a spatial field.


2) Use of Web Browser Cache Containing Sensitive Information (CVE-ID: CVE-2026-6907)

CWE-ID: CWE-525 - Use of Web Browser Cache Containing Sensitive Information

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cache handling in django.middleware.cache.UpdateCacheMiddleware when processing responses whose Vary header contains an asterisk ('*'). A remote attacker can trigger caching of private data to disclose sensitive information.

Private data may be stored in the cache and later served to other users.


3) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-8404)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to "django.middleware.cache.UpdateCacheMiddleware" does not match "Cache-Control" response directives case-insensitively. A remote attacker can gain access to sensitive information on the system.


Remediation

Install update from vendor's website.

References