FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Affected packages
py27-django111 < 1.11.22
py35-django111 < 1.11.22
py36-django111 < 1.11.22
py37-django111 < 1.11.22
py35-django21 < 2.1.10
py36-django21 < 2.1.10
py37-django21 < 2.1.10
py35-django22 < 2.2.3
py36-django22 < 2.2.3
py37-django22 < 2.2.3


VuXML ID b805d7b4-9c0c-11e9-97f0-000c29e96db4
Discovery 2019-07-01
Entry 2019-07-01

Django security releases issued:

When deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure(), and build_absolute_uri(), and that HTTP requests would not be redirected to HTTPS in accordance with SECURE_SSL_REDIRECT.


CVE Name CVE-2019-12781