CVE-2019-12781: Cleartext Transmission of Sensitive Information in Django
Summary
CVE-2019-12781: Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS. Affects django across 3 version ranges.
>= 1.11, < 1.11.22
>= 2.1, < 2.1.10
>= 2.2, < 2.2.3
Fixed in 1.11.22, 2.1.10 or 2.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2019-12781 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers features such as URL routing, template engine, database integration, and user authentication. Django is widely used in various industries and has a large community of developers.
Vulnerability Detail
The vulnerability identified as CVE-2019-12781 affects Django versions 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. When the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, an HTTP request is not redirected to HTTPS when the proxy connects to Django via HTTPS. This behavior occurs due to incorrect behavior in the django.http.HttpRequest.scheme. As a result, sensitive information can be transmitted over cleartext HTTP connections, potentially exposing it to eavesdropping and interception.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.221.11.22pip install --upgrade "django==1.11.22" -
>= 2.1, < 2.1.102.1.10pip install --upgrade "django==2.1.10" -
>= 2.2, < 2.2.32.2.3pip install --upgrade "django==2.2.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a workaround can be implemented by manually redirecting HTTP requests to HTTPS at the web server or load balancer level. This can be achieved by configuring the server or load balancer to redirect all incoming HTTP requests to their corresponding HTTPS counterparts. The specific steps to implement this workaround may vary depending on the server or load balancer being used.
Conclusion
In conclusion, CVE-2019-12781 is a vulnerability in Django that allows for the transmission of sensitive information over cleartext HTTP connections. It is crucial to upgrade Django to the fixed versions or implement the recommended workaround to ensure the security and privacy of users' data. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows for the transmission of sensitive information over cleartext HTTP connections, potentially exposing it to eavesdropping and interception. This can lead to unauthorized access to sensitive data, compromising the security and privacy of users.
Django versions 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3 are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the necessary fixes and security patches to mitigate any potential risks.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
For more information about this vulnerability, you can refer to the official GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-6c7v-2f49-8h26/GHSA-6c7v-2f49-8h26.json
Related vulnerabilities
Recent vulnerabilities recorded for django.
