Vulnerability Description
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 1.11, < 1.11.22 |
| Canonical | Ubuntu Linux | 16.04 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- http://www.openwall.com/lists/oss-security/2019/07/01/3Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/109018Third Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security/PatchVendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Jul/10Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190705-0002/Third Party Advisory
- https://usn.ubuntu.com/4043-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4476Third Party Advisory
- https://www.djangoproject.com/weblog/2019/jul/01/security-releases/PatchVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
- http://www.openwall.com/lists/oss-security/2019/07/01/3Mailing ListPatchThird Party Advisory
FAQ
What is CVE-2019-12781?
CVE-2019-12781 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT sett...
How severe is CVE-2019-12781?
CVE-2019-12781 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12781?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Canonical Ubuntu Linux, Debian Debian Linux.