Andrew Gonzalez

An issue exists where `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value. This behavior could allow remote attackers to access private data cached for a different request.

An inconsistent user interface issue was addressed with improved state management, allowing a person with physical access to an iOS device to potentially access contacts from the lock screen.