{"schemaVersion":3,"id":"USN-8848-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"python-django vulnerabilities\n\nBence Nagy discovered that GeoDjango in Django incorrectly handled spatial\nlookups when processing untrusted input. A remote attacker could possibly\nuse this issue to make outbound network requests, write arbitrary files, or\nexecute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)\n\nAhmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly\ncached requests where the Vary header contained an asterisk. A remote\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2026-6907)\n\nAhmed Badawe discovered that Django did not properly parse Cache-Control\nresponse directives case-insensitively under certain circumstances. A\nremote attacker could possibly use this issue to view sensitive information\nfrom responses that were incorrectly cached. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-8404)","dates":{"published":"2026-09-30T08:09:14.000Z","modified":"2026-10-02T12:26:44.722Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"python-django","name":"python-django","label":"python-django","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python-django","purlType":"deb","versions":[{"text":"< 1.6.11-0ubuntu1.3+esm12","noFixRecorded":false,"fixedIn":null},{"text":"< 1.8.7-1ubuntu5.15+esm13","noFixRecorded":false,"fixedIn":null},{"text":"< 1:1.11.11-1ubuntu1.21+esm17","noFixRecorded":false,"fixedIn":null},{"text":"< 2:2.2.12-1ubuntu0.29+esm10","noFixRecorded":false,"fixedIn":null},{"text":"< 2:3.2.12-2ubuntu1.29","noFixRecorded":false,"fixedIn":null},{"text":"< 3:4.2.11-1ubuntu1.18","noFixRecorded":false,"fixedIn":null},{"text":"< 3:5.2.9-0ubuntu4.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.11-0ubuntu1.3+esm12 | < 1.8.7-1ubuntu5.15+esm13 | < 1:1.11.11-1ubuntu1.21+esm17 | < 2:2.2.12-1ubuntu0.29+esm10 | < 2:3.2.12-2ubuntu1.29 | < 3:4.2.11-1ubuntu1.18 | < 3:5.2.9-0ubuntu4.3","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8848-1","label":"ubuntu.com/security/notices/USN-8848-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6907","label":"ubuntu.com/security/CVE-2026-6907","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-8404","label":"ubuntu.com/security/CVE-2026-8404","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-15307","label":"ubuntu.com/security/CVE-2026-15307","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-15307","CVE-2026-6907","CVE-2026-8404"],"downstream":[],"duplicates":[],"related":["CVE-2026-15307","CVE-2026-6907","CVE-2026-8404"]},"timeline":[{"kind":"published","date":"2026-09-30T08:09:14.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-02T12:26:44.722Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:20:02.143Z","stale":false,"partial":false}}