Published: 01/07/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

An issue exists in Django 1.11 prior to 1.11.22, 2.1 prior to 2.1.10, and 2.2 prior to 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djangoproject django
canonical ubuntu linux 16.04
debian debian linux 9.0
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
canonical ubuntu linux 19.04

Debian Bug report logs - #931316 python-django: CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS Package: src:python-django; Maintainer for src:python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> ...

Several security issues were fixed in Django ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform15 (Stein)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform13 (Queens)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System ...

Synopsis Important: Satellite 68 release Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Satellite 68 for RHEL 7Red Hat Product Security has rated this update as having a security impactof Important A Common Vulnerability Scoring System (CVSS) base score,which giv ...

Three security issues were found in Django, a Python web development framework, which could result in denial of service, incomplete sanitisation of clickable links or missing redirects of HTTP requests to HTTPS For the stable distribution (stretch), these problems have been fixed in version 1:1107-2+deb9u5 We recommend that you upgrade your pyt ...

Impact: Moderate Public Date: 2019-07-01 CWE: (CWE-358|CWE-444) Bugzilla: 1724497: CVE-2019-12781 Djang ...

An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS In other words, djangohttpHttpRequestscheme has incorrect behavior when a client uses HTTP ...

CWE-319 https://www.djangoproject.com/weblog/2019/jul/01/security-releases/https://docs.djangoproject.com/en/dev/releases/security/http://www.openwall.com/lists/oss-security/2019/07/01/3 https://usn.ubuntu.com/4043-1/http://www.securityfocus.com/bid/109018 https://security.netapp.com/advisory/ntap-20190705-0002/https://www.debian.org/security/2019/dsa-4476 https://seclists.org/bugtraq/2019/Jul/10 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931316 https://usn.ubuntu.com/4043-1/https://nvd.nist.gov

CVE-2019-12781

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect