GHSA-h7pc-vwp9-298g
Django: signed cookies are vulnerable to salt namespace collisions
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-6873
- Alias
- BIT-django-2026-6873, PYSEC-2026-199
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · django | introduced 0, fixed 5.2.15 |
| PyPI · django | introduced 6.0.0, fixed 6.0.6 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-6873 ADVISORY
- https://github.com/django/django/commit/594360cbf58be7f56eb6da96d58644297c99ef85 WEB
- https://github.com/django/django/commit/70d36515b9cc71700105a14b275583070d48b689 WEB
- https://github.com/django/django/commit/c807d9c398022d23cb27518fa6ecaf343efb30cf WEB
- https://docs.djangoproject.com/en/dev/releases/security WEB
- https://github.com/django/django PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-199.yaml WEB
- https://groups.google.com/g/django-announce WEB
- https://www.djangoproject.com/weblog/2026/jun/03/security-releases WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |