Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

🗓️ 03 Jul 2019 20:37:25Reported by GitHub Advisory DatabaseType

Django HTTP detection issue with reverse-proxy

Reporter	Title	Published	Views	Family All 128
ALT Linux	Security fix for the ALT Linux 9 package python3-module-django version 2.2.3-alt1	15 Jul 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 2.2.3-alt1	15 Jul 201900:00	–	altlinux
AlpineLinux	CVE-2019-12781	1 Jul 201913:56	–	alpinelinux
ArchLinux	[ASA-201907-2] python-django: silent downgrade	6 Jul 201900:00	–	archlinux
ArchLinux	[ASA-201907-3] python2-django: silent downgrade	6 Jul 201900:00	–	archlinux
FreeBSD	Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS	1 Jul 201900:00	–	freebsd
BDU FSTEC	The vulnerability of the `django.http.HttpRequest.scheme` component in the Django library for the Python programming language allows attackers to access protected information.	16 Jul 201900:00	–	bdu_fstec
CNVD	Django Security Bypass Vulnerability (CNVD-2019-21074)	3 Jul 201900:00	–	cnvd
CVE	CVE-2019-12781	1 Jul 201913:56	–	cve
Cvelist	CVE-2019-12781	1 Jul 201913:56	–	cvelist

Vulners

Node

django_project djangoRange1.11–1.11.22pip

django_project djangoRange2.1–2.1.10pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-12781
openwall	www.openwall.com/lists/oss-security/2019/07/01/3
groups	www.groups.google.com/forum/
seclists	www.seclists.org/bugtraq/2019/Jul/10
debian	www.debian.org/security/2019/dsa-4476
lists	www.lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
lists	www.lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
docs	www.docs.djangoproject.com/en/dev/releases/security
github	www.github.com/advisories/GHSA-6c7v-2f49-8h26
github	www.github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-10.yaml

18 Sep 2024 16:15Current

6.1Medium risk

Vulners AI Score6.1

CVSS 25

CVSS 35.3

EPSS0.04217