Stay Secure with the Latest Linux Advisories

security advisoryupdatedebian

Debian: DLA-1842-1 Moderate: Python-Django HTTP Connection Issue Resolution

It was discovered that the Django Python web development framework did not correct identify HTTP connections when a reverse proxy connected via HTTPS. . Package : python-django Version : 1.7.11-1+deb8u6 CVE ID : CVE-2019-12308 Debian Bug : #931316 It was discovered that the Django Python web development framework did not correct identify HTTP connections when a reverse proxy connected via HTTPS. When deployed behind a reverse-proxy connecting to Django via HTTPS django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This resulted in incorrect results for is_secure(), and build_absolute_uri(), and that HTTP requests would not be redirected to HTTPS in accordance with SECURE_SSL_REDIRECT. HttpRequest.scheme now respects SECURE_PROXY_SSL_HEADER, if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure to verify that your application correctly handles code paths relying on scheme, is_secure(), build_absolute_uri(), and SECURE_SSL_REDIRECT. For Debian 8 "Jessie", this issue has been fixed in python-django version 1.7.11-1+deb8u6. We recommend that you upgrade your python-django packages. Regards, - -- ,'`. : :' : Chris Lamb `. `'` This email address is being protected from spambots. You need JavaScript enabled to view it. / chris-lamb.co.uk `- . The Django framework has issues recognizing HTTP connections accurately; a patch is released for Debian 8 to improve safety protocols.. Django, Security Update, HTTP Detection, Reverse Proxy, Debian. . LinuxSecurity.com Team

Jul 01, 2019 Debian LTS