An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1324 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * Incorrect HTTP detection with reverse-proxy connecting via HTTPS     (CVE-2019-12781)

    * backtracking in a regular expression in django.utils.text.Truncator leads     to DoS (CVE-2019-14232)

    * the behavior of the underlying HTMLParser leading to DoS (CVE-2019-14233)

    * SQL injection possibility in key and index lookups for     JSONField/HStoreField (CVE-2019-14234)

    * Potential memory exhaustion in django.utils.encoding.uri_to_iri()     (CVE-2019-14235)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
    * rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
    * puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
    * jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547     CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
    * foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
    * Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)
    * Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
    * rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
    * rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)
    * rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
    * rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)
    * puppet: Arbitrary catalog retrieval (CVE-2020-7942)
    * rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
    * rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)
    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)
    * puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL     (CVE-2018-11751)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration     and deployment.

    * Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment

    * Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with     a single job execution.

    * Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet

    * Support for HTTP UEFI provisioning

    * Support for CAC card authentication with Keycloak integration

    * Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.

    * Support for Red Hat Enterprise Linux Traces integration

    * satellite-maintain & foreman-maintain are now self updating

    * Notifications in the UI to warn users when subscriptions are expiring.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4390 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    Security Fix(es):

    * Incorrect HTTP detection with reverse-proxy connecting via HTTPS     (CVE-2019-12781)

    * backtracking in a regular expression in django.utils.text.Truncator leads     to DoS (CVE-2019-14232)

    * the behavior of the underlying HTMLParser leading to DoS (CVE-2019-14233)

    * SQL injection possibility in key and index lookups for     JSONField/HStoreField (CVE-2019-14234)

    * Potential memory exhaustion in django.utils.encoding.uri_to_iri()     (CVE-2019-14235)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python-Django fixes the following issues :

Security issues fixed :

&#9; - CVE-2019-11358: Fixed prototype pollution.

  - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget     (bsc#1136468)

  - CVE-2019-12781: Fixed incorrect HTTP detection with     reverse-proxy connecting via HTTPS (bsc#1139945).

  - CVE-2019-14232: Fixed denial-of-service possibility in     ``django.utils.text.Truncator`` (bsc#1142880).

  - CVE-2019-14233: Fixed denial-of-service possibility in     ``strip_tags()`` (bsc#1142882).

  - CVE-2019-14234: Fixed SQL injection possibility in key     and index lookups for ``JSONField``/``HStoreField``     (bsc#1142883).

  - CVE-2019-14235: Fixed potential memory exhaustion in     ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).

Non-security issues fixed :

  - Fixed a migration crash on PostgreSQL when adding a     check constraint with a contains lookup on     DateRangeField or DateTimeRangeField, if the right hand     side of an expression is the same type.

update to 2.1.10, security fix for CVE-2019-12781

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three security issues were found in Django, a Python web development framework, which could result in denial of service, incomplete sanitisation of clickable links or missing redirects of HTTP requests to HTTPS.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4043-1 advisory.

    It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10 and Ubuntu 19.04.
    (CVE-2019-12308)

    Gavin Wahl discovered that Django incorrectly handled HTTP detection when used behind a reverse-proxy.
    Client requests made via HTTP would cause incorrect API results and would not be redirected to HTTPS,     contrary to expectations. (CVE-2019-12781)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Django security releases issued :

When deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure(), and build_absolute_uri(), and that HTTP requests would not be redirected to HTTPS in accordance with SECURE_SSL_REDIRECT.

ID	Name	Product	Family	Severity
170305	RHEL 8 : python-django (RHSA-2020:1324)	Nessus	Red Hat Local Security Checks	critical
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	critical
142030	RHEL 7 : python-django (RHSA-2020:4390)	Nessus	Red Hat Local Security Checks	critical
127742	openSUSE Security Update : python-Django (openSUSE-2019-1839)	Nessus	SuSE Local Security Checks	critical
126664	Fedora 30 : python-django (2019-d9aa58d863)	Nessus	Fedora Local Security Checks	medium
126514	Debian DSA-4476-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
126445	Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerabilities (USN-4043-1)	Nessus	Ubuntu Local Security Checks	medium
126414	FreeBSD : Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS (b805d7b4-9c0c-11e9-97f0-000c29e96db4)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-12781

medium

Tenable Plugins

critical

critical

critical

critical

medium

medium

medium

medium