diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-03-24 14:06:22 -0400 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2026-06-03 08:37:26 -0300 |
| commit | a2faa8e895926ac5d63f72879b5ccf671b5b4ba9 (patch) | |
| tree | 2bc79b60c786295abb811208814d1ce48acae9db /docs | |
| parent | d618d7ae4fec727d5b582bd24f803c28d17bf7cd (diff) | |
Fixed CVE-2026-35193 -- Varied on Authorization when caching non-public responses.
Thanks Shai Berger for the report, and Natalia Bidart and Sarah Boyce for reviews.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/5.2.15.txt | 13 | ||||
| -rw-r--r-- | docs/releases/6.0.6.txt | 13 | ||||
| -rw-r--r-- | docs/topics/cache.txt | 12 |
3 files changed, 38 insertions, 0 deletions
diff --git a/docs/releases/5.2.15.txt b/docs/releases/5.2.15.txt index c068600280..ed95b646ce 100644 --- a/docs/releases/5.2.15.txt +++ b/docs/releases/5.2.15.txt @@ -51,3 +51,16 @@ where ``Cache-Control`` is set manually. This issue has severity "low" according to the :ref:`Django security policy <severity-levels>`. + +CVE-2026-35193: Potential exposure of private data via missing ``Vary: Authorization`` +====================================================================================== + +:class:`~django.middleware.cache.UpdateCacheMiddleware` and +:func:`~django.views.decorators.cache.cache_page` decorator allowed responses +to requests bearing an ``Authorization`` header (and without ``Cache-Control: +public``) to be cached. To conform with the existing mechanism for constructing +cache keys, responses to these requests will now :ref:`vary on +<using-vary-headers>` ``Authorization``. + +This issue has severity "low" according to the :ref:`Django security policy +<severity-levels>`. diff --git a/docs/releases/6.0.6.txt b/docs/releases/6.0.6.txt index afcbbe0eb2..a460621232 100644 --- a/docs/releases/6.0.6.txt +++ b/docs/releases/6.0.6.txt @@ -53,6 +53,19 @@ where ``Cache-Control`` is set manually. This issue has severity "low" according to the :ref:`Django security policy <severity-levels>`. +CVE-2026-35193: Potential exposure of private data via missing ``Vary: Authorization`` +====================================================================================== + +:class:`~django.middleware.cache.UpdateCacheMiddleware` and +:func:`~django.views.decorators.cache.cache_page` decorator allowed responses +to requests bearing an ``Authorization`` header (and without ``Cache-Control: +public``) to be cached. To conform with the existing mechanism for constructing +cache keys, responses to these requests will now :ref:`vary on +<using-vary-headers>` ``Authorization``. + +This issue has severity "low" according to the :ref:`Django security policy +<severity-levels>`. + Bugfixes ======== diff --git a/docs/topics/cache.txt b/docs/topics/cache.txt index 37384c3b8a..9af28a9324 100644 --- a/docs/topics/cache.txt +++ b/docs/topics/cache.txt @@ -1403,6 +1403,18 @@ second argument. For more on Vary headers, see the :rfc:`official Vary spec <9110#section-12.5.5>`. +.. admonition:: ``CacheMiddleware`` varies on ``Authorization`` automatically + + Although varying on ``Authorization`` is not strictly necessary given that + :rfc:`9111#section-3.5` allows caches to avoid reusing authenticated + responses, Django's ``CacheMiddleware`` adds ``Authorization`` to the + ``Vary`` header to simplify construction of cache keys. + +.. versionchanged:: 6.0.6 + + Previously, ``UpdateCacheMiddleware`` did not vary on ``Authorization`` for + requests bearing that header. + Controlling cache: Using other headers ====================================== |