CVE-2019-12781

Published: Jul 1, 2019Modified: Jun 17, 2026

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Affected (8)

Products: Djangoproject: Django · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 1.11 to 1.11.22
Djangoproject Django	From 2.1 to 2.1.10
Djangoproject Django	From 2.2 to 2.2.3

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04
Debian Debian Linux	Version 9.0

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2019/07/01/3

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/109018

Source: cve@mitre.org

Third Party Advisory

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

PatchVendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Jul/10

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190705-0002/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4043-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4476

Source: cve@mitre.org

Third Party Advisory

https://www.djangoproject.com/weblog/2019/jul/01/security-releases/

Source: cve@mitre.org

PatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2019/07/01/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/109018

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://docs.djangoproject.com/en/dev/releases/security/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/Jul/10

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190705-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4043-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4476

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.djangoproject.com/weblog/2019/jul/01/security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.