FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Affected packages
	py27-django111	<	1.11.22
	py35-django111	<	1.11.22
	py36-django111	<	1.11.22
	py37-django111	<	1.11.22
	py35-django21	<	2.1.10
	py36-django21	<	2.1.10
	py37-django21	<	2.1.10
	py35-django22	<	2.2.3
	py36-django22	<	2.2.3
	py37-django22	<	2.2.3

Details

VuXML ID	b805d7b4-9c0c-11e9-97f0-000c29e96db4
Discovery	2019-07-01
Entry	2019-07-01

Django security releases issued:

When deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure(), and build_absolute_uri(), and that HTTP requests would not be redirected to HTTPS in accordance with SECURE_SSL_REDIRECT.

[source]

References

CVE Name	CVE-2019-12781
URL	https://www.djangoproject.com/weblog/2019/jul/01/security-releases/