Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-12781US | medium5.3OT erhöht | — | ||
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECU… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlWEB
- http://www.openwall.com/lists/oss-security/2019/07/01/3WEB
- https://docs.djangoproject.com/en/dev/releases/securityWEB
- https://github.com/advisories/GHSA-6c7v-2f49-8h26ADVISORY
- https://github.com/django/djangoPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-10.yamlWEB
- https://groups.google.com/forum/#!topic/django-announce/Is4kLY9ZcZQWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan