PT-2019-20161 · Django Software Foundation · Django

Publicado 2019-07-01 · Atualizado 2019-07-01

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.22 Django versions 2.1 before 2.1.10 Django versions 2.2 before 2.2.3

Description An issue was discovered where an HTTP request is not redirected to HTTPS when the SECURE PROXY SSL HEADER and SECURE SSL REDIRECT settings are used, and the proxy connects to Django via HTTPS. This results in incorrect behavior of django.http.HttpRequest.scheme when a client uses HTTP.

Recommendations For Django version 1.11, update to version 1.11.22 or later. For Django version 2.1, update to version 2.1.10 or later. For Django version 2.2, update to version 2.2.3 or later.

Identificadores relacionados

PYSEC-2019-80

Produtos afetados

Django

Referências · 13

• https://djangoproject.com/weblog/2019/jul/01/security-releases · Nota
• https://debian.org/security/2019/dsa-4476 · Aviso do Fabricante
• https://seclists.org/bugtraq/2019/Jul/10 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html · Nota
• https://docs.djangoproject.com/en/dev/releases/security · Nota
• https://osv.dev/vulnerability/PYSEC-2019-80 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/07/01/3 · Nota
• https://security.netapp.com/advisory/ntap-20190705-0002 · Nota
• https://groups.google.com/forum/#!topic/django-announce/Is4kLY9ZcZQ · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Nota
• http://securityfocus.com/bid/109018 · Nota
• https://usn.ubuntu.com/4043-1 · Nota