Django UpdateCacheMiddleware Vary Header Handling Vulnerability

A vulnerability exists in Django's UpdateCacheMiddleware in versions 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14. The middleware incorrectly caches requests with a Vary header containing an asterisk, leading to the unintentional storage and serving of private data. While this issue has been evaluated in supported Django versions, earlier unsupported series may also be affected.

Impact

Exploitation of this vulnerability could result in the unintended caching of private data, which could then be served to users inappropriately.

Remediation

Users can upgrade to Django versions 6.0.5 or 5.2.14 to address this vulnerability.