A new Debian Linux update has been published: ELA-659-1 mod-wsgi security update
A mod-wsgi security update has been released for Debian GNU/Linux 9 Extended LTS to address an issue where a request from an untrusted proxy does not remove the X-Client-IP header and thus allowing this header to be passed to the target WSGI application.Read more @ Linux Compatible