Django Cache Middleware Response Caching Vulnerability

A vulnerability exists in Django's cache middleware that can lead to the improper caching of responses marked as private. This issue is present in Django versions 5.2 prior to 5.2.15 and 6.0 prior to 6.0.6. The problem arises because the `UpdateCacheMiddleware` does not handle `Cache-Control` response directives in a case-insensitive manner. As a result, remote attackers may be able to read responses that were incorrectly cached due to uppercase or mixed-case `Cache-Control` values. While this vulnerability has been identified in the current Django series, earlier unsupported versions may also be affected.

Impact

Exploitation of this vulnerability could result in the unintended exposure of private data through incorrectly cached responses.

Remediation

Users can upgrade to Django versions 5.2.15 or 6.0.6 to address this vulnerability.