Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-12781US | medium5.3OT elevated | — | ||
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECU… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlWEB
- http://www.openwall.com/lists/oss-security/2019/07/01/3WEB
- https://docs.djangoproject.com/en/dev/releases/securityWEB
- https://github.com/advisories/GHSA-6c7v-2f49-8h26ADVISORY
- https://github.com/django/djangoPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-10.yamlWEB
- https://groups.google.com/forum/#!topic/django-announce/Is4kLY9ZcZQWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan