FreeBSD : Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS (b805d7b4-9c0c-11e9-97f0-000c29e96db4)

medium Nessus Plugin ID 126414

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Django security releases issued :

When deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure(), and build_absolute_uri(), and that HTTP requests would not be redirected to HTTPS in accordance with SECURE_SSL_REDIRECT.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 126414

File Name: freebsd_pkg_b805d7b49c0c11e997f0000c29e96db4.nasl

Version: 1.3

Type: local

Family: FreeBSD Local Security Checks

Published: 7/2/2019

Updated: 1/8/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:py27-django111, p-cpe:/a:freebsd:freebsd:py35-django111, p-cpe:/a:freebsd:freebsd:py35-django21, p-cpe:/a:freebsd:freebsd:py35-django22, p-cpe:/a:freebsd:freebsd:py36-django111, p-cpe:/a:freebsd:freebsd:py36-django21, p-cpe:/a:freebsd:freebsd:py36-django22, p-cpe:/a:freebsd:freebsd:py37-django111, p-cpe:/a:freebsd:freebsd:py37-django21, p-cpe:/a:freebsd:freebsd:py37-django22, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 7/1/2019

Vulnerability Publication Date: 7/1/2019

Reference Information

CVE: CVE-2019-12781

Detections

Analytics