CVE-2019-12781
Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
Se ha descubierto un problema en Django en versiones 1.11 anteriores a la 1.11.22, 2.1, anteriores a la 2.1.10, y 2.2 anteriores 2.2.3. Una petición HTTP no se redirige a HTTPS cuando se usan las configuraciones SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT, y el proxy se conecta a Django a través de HTTPS. En otras palabras, django.http.HttpRequest.scheme tiene un comportamiento incorrecto cuando un cliente usa HTTP.
An HTTP detection flaw was discovered in Django. If deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme() incorrectly detected client requests made using HTTP as using HTTPS. This resulted in incorrect results for is_secure() and build_absolute_uri(), and HTTP requests were not correctly redirected to HTTPS in accordance with SECURE_SSL_REDIRECT.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-06-10 CVE Reserved
- 2019-07-01 CVE Published
- 2024-08-04 CVE Updated
- 2024-11-21 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/109018 | Third Party Advisory | |
| https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ | X_refsource_misc | |
| https://seclists.org/bugtraq/2019/Jul/10 | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20190705-0002 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2019/07/01/3 | 2023-11-07 | |
| https://docs.djangoproject.com/en/dev/releases/security | 2023-11-07 | |
| https://www.djangoproject.com/weblog/2019/jul/01/security-releases | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 1.11 < 1.11.22 Search vendor "Djangoproject" for product "Django" and version " >= 1.11 < 1.11.22" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 2.1 < 2.1.10 Search vendor "Djangoproject" for product "Django" and version " >= 2.1 < 2.1.10" | - |
Affected
| ||||||
| Djangoproject Search vendor "Djangoproject" | Django Search vendor "Djangoproject" for product "Django" | >= 2.2 < 2.2.3 Search vendor "Djangoproject" for product "Django" and version " >= 2.2 < 2.2.3" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 19.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "19.04" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||