PT-2019-2628 · Django Software Foundation+3 · Django+3

Gavin Wahl · Published 2019-07-01 · Updated 2026-01-03 · CVE-2019-12781

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.22 Django versions 2.1 before 2.1.10 Django versions 2.2 before 2.2.3

Description An issue in Django causes incorrect behavior of django.http.HttpRequest.scheme when a client uses HTTP, but the proxy connects to Django via HTTPS, and the SECURE PROXY SSL HEADER and SECURE SSL REDIRECT settings are used. This issue is related to errors in processing HTTP requests that are determined as HTTPS requests. The exploitation of this issue may allow a remote attacker to access protected information.

Recommendations For Django version 1.11 before 1.11.22, update to version 1.11.22 or later. For Django version 2.1 before 2.1.10, update to version 2.1.10 or later. For Django version 2.2 before 2.2.3, update to version 2.2.3 or later.

Fix

RCE

Cleartext Transmission of Sensitive Information

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-20

CWE-319

CWE-444

Related Identifiers

ALT-PU-2019-2367

BDU:2019-02513

CVE-2019-12781

DLA-1842-1

DSA-4476-1

GHSA-6C7V-2F49-8H26

OPENSUSE-SU-2019:1839-1

OPENSUSE-SU-2019:1872-1

OPENSUSE-SU-2019_1839-1

OPENSUSE-SU-2024:11205-1

OPENSUSE-SU-2024:13887-1

OPENSUSE-SU-2024:14208-1

OPENSUSE-SU-2026:10005-1

PYSEC-2019-10

RHSA-2020:1324

RHSA-2020:4366

RHSA-2020:4390

SUSE-SU-2019:2257-1

SUSE-SU-2019:2335-1

SUSE-SU-2019:2379-1

SUSE-SU-2019:3127-1

USN-4043-1

Affected Products

Alt Linux

Django

Suse

Ubuntu

References · 134

• https://djangoproject.com/weblog/2019/jul/01/security-releases · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12781 · Security Note
• https://osv.dev/vulnerability/GHSA-6c7v-2f49-8h26 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14208-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2257-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/07/01/3 · Patch
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12781 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10005-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13887-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4043-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html · Vendor Advisory
• https://debian.org/security/2019/dsa-4476 · Vendor Advisory