CVE-2019-12781

Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Published Jul 1, 2019 CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Description
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-4476-1 python-django security update
Github GHSA Github GHSA GHSA-6c7v-2f49-8h26 Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
Ubuntu USN Ubuntu USN USN-4043-1 Django vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 4, 2024, 11:32 PM
Reserved
Jun 10, 2019, 12:00 AM
Status
Modified
Published
Jul 1, 2019, 2:15 PM
Modified
Jun 17, 2026, 2:15 AM
Severity
Moderate
Public date
Jul 1, 2019, 12:00 AM