Django HTTP to HTTPS Redirection Flaw in py-django and py3-django Packages
Summary
ALPINE-CVE-2019-12781: An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. Affects py-django versions < 1.11.22-r0. Fixed in 1.11.22-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and offers features such as an ORM, routing, and templating. The py-django and py3-django packages are Alpine Linux ports of Django, providing the same functionalities. However, these packages are vulnerable to a flaw that affects the secure handling of HTTP requests when using proxy settings.
Vulnerability Detail
An issue was discovered in Django versions prior to 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. The vulnerability arises when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, causing HTTP requests to not be redirected to HTTPS when the proxy connects to Django via HTTPS. This can lead to security risks, as clients may inadvertently communicate over an insecure connection. The technical aspect of this vulnerability lies in the incorrect behavior of django.http.HttpRequest.scheme when handling requests through a proxy.
How To Fix
Minimum fixed version
1.11.22-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the SECURE_SSL_REDIRECT setting in your Django settings file to prevent the issue from occurring until you can update to the patched version. However, this is not recommended for production environments as it may expose users to security risks.
Conclusion
The vulnerability in the py-django and py3-django packages poses a significant risk by failing to redirect HTTP requests to HTTPS under certain proxy configurations. It is crucial to update to the patched version to ensure secure communication and protect user data.
See every vulnerability recorded for py-django →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Django versions prior to 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code or installation.
The primary risk is that users may communicate over an insecure HTTP connection instead of HTTPS, which can expose sensitive data to interception.
While the best solution is to update to the patched version, you can temporarily disable the SECURE_SSL_REDIRECT setting in your Django settings as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
