SUSE-SU-2026:2318-1

Vulnerability from csaf_suse - Published: 2026-06-09 13:22 - Updated: 2026-06-09 13:22
Summary
Security update for python-Django
Severity
Important
Notes
Title of the patch: Security update for python-Django
Description of the patch: This update for python-Django fixes the following issues - CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie` (bsc#1267578). - CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend (bsc#1267579). - CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in `UpdateCacheMiddleware` (bsc#1267580). - CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware` (bsc#1267576). - CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header (bsc#1267577).
Patchnames: SUSE-2026-2318,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2318
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-35193
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-48587
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-6873
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-7666
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-8404
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-Django",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-Django fixes the following issues\n\n- CVE-2026-6873: signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie` (bsc#1267578).\n- CVE-2026-7666: potential unencrypted email transmission via `STARTTLS` in the SMTP backend (bsc#1267579).\n- CVE-2026-8404: potential exposure of private data via case-sensitive `Cache-Control` directives in\n  `UpdateCacheMiddleware` (bsc#1267580).\n- CVE-2026-35193: potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware`\n  (bsc#1267576).\n- CVE-2026-48587: potential exposure of private data via whitespace padding in `Vary` header (bsc#1267577).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-2318,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2318",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2318-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:2318-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20262318-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:2318-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047219.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267576",
        "url": "https://bugzilla.suse.com/1267576"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267577",
        "url": "https://bugzilla.suse.com/1267577"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267578",
        "url": "https://bugzilla.suse.com/1267578"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267579",
        "url": "https://bugzilla.suse.com/1267579"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267580",
        "url": "https://bugzilla.suse.com/1267580"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-35193 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-35193/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48587 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48587/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6873 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6873/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-7666 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-7666/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-8404 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-8404/"
      }
    ],
    "title": "Security update for python-Django",
    "tracking": {
      "current_release_date": "2026-06-09T13:22:04Z",
      "generator": {
        "date": "2026-06-09T13:22:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:2318-1",
      "initial_release_date": "2026-06-09T13:22:04Z",
      "revision_history": [
        {
          "date": "2026-06-09T13:22:04Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-Django-4.2.11-150600.3.59.1.noarch",
                "product": {
                  "name": "python311-Django-4.2.11-150600.3.59.1.noarch",
                  "product_id": "python311-Django-4.2.11-150600.3.59.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Django-4.2.11-150600.3.59.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        },
        "product_reference": "python311-Django-4.2.11-150600.3.59.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-35193",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-35193"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Shai Berger for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-35193",
          "url": "https://www.suse.com/security/cve/CVE-2026-35193"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267576 for CVE-2026-35193",
          "url": "https://bugzilla.suse.com/1267576"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-09T13:22:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-35193"
    },
    {
      "cve": "CVE-2026-48587",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48587"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Navid Rezazadeh for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48587",
          "url": "https://www.suse.com/security/cve/CVE-2026-48587"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267576 for CVE-2026-48587",
          "url": "https://bugzilla.suse.com/1267576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267577 for CVE-2026-48587",
          "url": "https://bugzilla.suse.com/1267577"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-09T13:22:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48587"
    },
    {
      "cve": "CVE-2026-6873",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6873"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Peng Zhou for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6873",
          "url": "https://www.suse.com/security/cve/CVE-2026-6873"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267576 for CVE-2026-6873",
          "url": "https://bugzilla.suse.com/1267576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267578 for CVE-2026-6873",
          "url": "https://bugzilla.suse.com/1267578"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-09T13:22:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-6873"
    },
    {
      "cve": "CVE-2026-7666",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-7666"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kasper Dupont for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-7666",
          "url": "https://www.suse.com/security/cve/CVE-2026-7666"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267576 for CVE-2026-7666",
          "url": "https://bugzilla.suse.com/1267576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267579 for CVE-2026-7666",
          "url": "https://bugzilla.suse.com/1267579"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-09T13:22:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-7666"
    },
    {
      "cve": "CVE-2026-8404",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-8404"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmed Badawe for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-8404",
          "url": "https://www.suse.com/security/cve/CVE-2026-8404"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267576 for CVE-2026-8404",
          "url": "https://bugzilla.suse.com/1267576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267580 for CVE-2026-8404",
          "url": "https://bugzilla.suse.com/1267580"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.59.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-09T13:22:04Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-8404"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.