CVE-2019-12781

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.22 Django versions 2.1 before 2.1.10 Django versions 2.2 before 2.2.3

Description An issue in Django causes incorrect behavior of django.http.HttpRequest.scheme when a client uses HTTP, but the proxy connects to Django via HTTPS, and the SECURE PROXY SSL HEADER and SECURE SSL REDIRECT settings are used. This issue is related to errors in processing HTTP requests that are determined as HTTPS requests. The exploitation of this issue may allow a remote attacker to access protected information.

Recommendations For Django version 1.11 before 1.11.22, update to version 1.11.22 or later. For Django version 2.1 before 2.1.10, update to version 2.1.10 or later. For Django version 2.2 before 2.2.3, update to version 2.2.3 or later.