diff options
| author | Wen Heping <wen@FreeBSD.org> | 2019-07-01 14:39:35 +0000 |
|---|---|---|
| committer | Wen Heping <wen@FreeBSD.org> | 2019-07-01 14:39:35 +0000 |
| commit | 72cddc5bca9ae3c555667d22cb2486a8cf7e9897 (patch) | |
| tree | 8da85135ed45a18f995783a36a2bf3dd04c99721 /security | |
| parent | 481d581651cc39fc52066103ceac79038e7947d3 (diff) | |
Notes
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 5cbf9c430b08..36924b92362e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="b805d7b4-9c0c-11e9-97f0-000c29e96db4"> + <topic>Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS</topic> + <affects> + <package> + <name>py27-django111</name> + <name>py35-django111</name> + <name>py36-django111</name> + <name>py37-django111</name> + <range><lt>1.11.22</lt></range> + </package> + <package> + <name>py35-django21</name> + <name>py36-django21</name> + <name>py37-django21</name> + <range><lt>2.1.10</lt></range> + </package> + <package> + <name>py35-django22</name> + <name>py36-django22</name> + <name>py37-django22</name> + <range><lt>2.2.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Django security releases issued:</p> + <blockquote cite="https://www.djangoproject.com/weblog/2019/jul/01/security-releases/"> + <p>When deployed behind a reverse-proxy connecting to Django via HTTPS, + django.http.HttpRequest.scheme would incorrectly detect client requests + made via HTTP as using HTTPS. This entails incorrect results for is_secure(), + and build_absolute_uri(), and that HTTP requests would not be redirected to + HTTPS in accordance with SECURE_SSL_REDIRECT.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2019-12781</cvename> + <url>https://www.djangoproject.com/weblog/2019/jul/01/security-releases/</url> + </references> + <dates> + <discovery>2019-07-01</discovery> + <entry>2019-07-01</entry> + </dates> + </vuln> + <vuln vid="4b6cb45d-881e-447a-a4e0-c97a954ea758"> <topic>bzip2 -- multiple issues</topic> <affects> |