CVE-2019-12781 — Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Description

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	python-django	1:1.11.22-1	—
Debian 13	python-django	1:1.11.22-1	—
Debian 12	python-django	1:1.11.22-1	—
Debian 9	python-django	1:1.10.7-2+deb9u5	DSA-4476-1
Debian 8	python-django	1.7.11-1+deb8u6	DLA-1842-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	python-django	1:1.11.11-1ubuntu1.4	USN-4043-1
Ubuntu 16.04 LTS	python-django	1.8.7-1ubuntu5.9	USN-4043-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	python-django	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	ansible-collection-redhat-satellite +1	1.3.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansible-runner +1	1.4.6-1.el7ar	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-foreman_scap_client	0.0.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-insights-client	1.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-satellite-receptor-installer	0.6.13-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	crane-selinux +1	3.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman +1	2.1.2.19-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-bootloaders-redhat +1	202005201200-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-discovery-image	1:3.6.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-discovery-image-service +1	1.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-installer +1	1:2.1.2.8-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-proxy +1	2.1.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	future +1	0.16.0-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	gofer +2	2.12.5-7.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	hfsplus-tools	332.14-12.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello +3	3.16.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello-certs-tools	2.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello-client-bootstrap	1.7.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	kobo	0.5.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libmodulemd	1.7.0-1.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libsolv +1	0.7.4-4.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libwebsockets	2.4.2-2.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp +14	2.21.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-docker +3	3.2.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-katello	1.0.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-ostree +3	1.3.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-rpm +8	2.21.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-agent	6.14.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-foreman_scap_client	0.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.25.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppetserver	6.13.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pycairo	1.16.3-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pygobject3 +2	3.28.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-amqp +1	2.2.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-anyjson +1	0.3.3-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-apypie +1	0.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-bson +2	3.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-celery +1	4.0.2-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-click +1	6.7-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-crane +1	3.3.1-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-daemon +1	2.1.2-7.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-django +1	1.11.29-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-flask +1	1:0.12.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-isodate +1	0.5.4-12.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-itsdangerous +1	0.24-15.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-jinja2 +1	2.10-10.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-jmespath +1	0.9.0-6.el7_7	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-kombu +1	10:4.0.2-13.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-lockfile +1	1:0.11.0-10.el7ar	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-markupsafe +1	0.23-21.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-nectar	1.6.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-okaara +1	1.0.37-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-pexpect +1	4.6-1.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-psutil	5.0.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-ptyprocess +1	0.5.2-3.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-pycurl +1	7.43.0.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-twisted +1	16.4.1-12.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-vine +1	10:1.1.3-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-werkzeug +1	0.12.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-28.el7amq	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-dispatch +2	1.5.0-4.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-proton +2	0.28.0-3.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	1.0.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	repoview	0.6.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-highline	1.7.8-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-oauth	0.5.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	satellite +3	6.8.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	satellite-installer	6.8.0.11-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm +1	6.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ansi	1.5.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-bundler_ext	0.4.1-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-clamp	1.1.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby	1:1.1.6-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.6.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	1.4.7-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-faraday	0.15.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-faraday_middleware	0.13.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.12.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-foreman-tasks-core	0.3.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_ansible_core	3.0.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-hashie	3.6.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-highline	1.7.8-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-infoblox	3.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-journald-logger	2.0.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-journald-native	1.0.11-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-jwt	2.2.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo	4.1.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo_parsers	1.1.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo_wizards	0.0.1-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-little-plugger	1.1.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-logging	2.2.2-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-logging-journald	2.0.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mime-types	3.2.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mime-types-data	3.2018.0812-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-multi_json	1.14.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-multipart-post	2.0.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mustermann	1.0.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.2.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.11.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-openscap	0.4.9-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-powerbar	2.0.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rack	2.2.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rb-inotify	0.9.7-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	2.0.2-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rkerberos	0.1.5-18.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rsec	0.4.3-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ruby-libvirt	0.7.0-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rubyipmi	0.10.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	5.7.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sinatra +1	2.0.3-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_ansible	3.0.1-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dhcp_infoblox	0.0.16-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dhcp_remote_isc	0.0.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_discovery	1.0.5-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_discovery_image	1.2.1-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dns_infoblox	1.0.0-7.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dynflow	0.2.4-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dynflow_core	0.2.6-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_openscap	0.7.3-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_pulp	2.1.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_remote_execution_ssh	0.3.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sqlite3	1.3.13-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-statsd-instrument	2.1.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-tilt	2.0.8-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-7.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.7.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-xmlrpc	0.3.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansible-collection-redhat-satellite	1.3.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansible-runner	1.4.6-1.el7ar	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-foreman_scap_client	0.0.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-insights-client	1.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-satellite-receptor-installer	0.6.13-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	candlepin +1	3.1.21-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	crane-selinux +1	3.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman +13	2.1.2.19-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-bootloaders-redhat +1	202005201200-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-discovery-image	1:3.6.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-discovery-image-service +1	1.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-installer +1	1:2.1.2.8-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-proxy +1	2.1.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-selinux	2.1.2.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	future	0.16.0-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	gofer +2	2.12.5-7.el7sat	RHSA-2020:4366
Red Hat Satellite 6	hfsplus-tools	332.14-12.el7	RHSA-2020:4366
Red Hat Satellite 6	katello +3	3.16.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	katello-certs-tools	2.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	katello-client-bootstrap	1.7.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	keycloak-httpd-client-install	1.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	kobo	0.5.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libmodulemd	1.7.0-1.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libsolv	0.7.4-4.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libwebsockets	2.4.2-2.el7	RHSA-2020:4366
Red Hat Satellite 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2020:4366
Red Hat Satellite 6	mod_passenger	4.0.18-24.el7sat	RHSA-2020:4366
Red Hat Satellite 6	mod_xsendfile	0.12-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHSA-2020:4366
Red Hat Satellite 6	pcp-mmvstatsd	0.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp +4	2.21.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-docker +2	3.2.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-katello	1.0.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-ostree +2	1.3.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-rpm +6	2.21.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-agent	6.14.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-foreman_scap_client	0.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppetlabs-stdlib	4.25.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppetserver	6.13.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pycairo	1.16.3-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pygobject3	3.28.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-aiohttp	3.6.2-4.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-amqp	2.2.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-anyjson	0.3.3-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-apypie	0.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-async-timeout	3.0.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-attrs	19.3.0-3.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-billiard	1:3.5.0.3-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-bson	3.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-celery	4.0.2-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-chardet	3.0.4-10.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-click	6.7-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-crane	3.3.1-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-daemon	2.1.2-7.el7at	RHSA-2020:4366
Red Hat Satellite 6	python-dateutil	2.8.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-django	1.11.29-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-flask	1:0.12.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHSA-2020:4366
Red Hat Satellite 6	python-idna	2.4-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-idna-ssl	1.1.0-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-isodate	0.5.4-12.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-itsdangerous	0.24-15.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-jinja2	2.10-10.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-jmespath	0.9.0-6.el7_7	RHSA-2020:4366
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-kombu	10:4.0.2-13.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-lockfile	1:0.11.0-10.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-markupsafe	0.23-21.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-multidict	4.7.4-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-nectar	1.6.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-okaara	1.0.37-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-pexpect	4.6-1.el7at	RHSA-2020:4366
Red Hat Satellite 6	python-prometheus-client	0.7.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-psutil	5.0.1-3.el7sat	RHSA-2020:4366
Red Hat OpenStack 15	python-django +2	2.1.11-1.el8ost	RHSA-2020:1324

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat OpenStack 13	python-django +2	1.11.27-1.el7ost	RHSA-2020:4390

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SUSE Package Hub 15 SP1	python-Django	2.2.4-bp151.3.3.1	openSUSE-SU-2019:1872-1
SUSE OpenStack Cloud Crowbar 9	python-Django1	1.11.23-3.9.1	SUSE-SU-2019:2335-1
SUSE OpenStack Cloud Crowbar 8	python-Django	1.11.23-3.12.1	SUSE-SU-2019:2257-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SUSE OpenStack Cloud 9	python-Django1	1.11.23-3.9.1	SUSE-SU-2019:2335-1
SUSE OpenStack Cloud 8	python-Django	1.11.23-3.12.1	SUSE-SU-2019:2257-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.18.1	SUSE-SU-2019:2379-1
SUSE HPE Helion OpenStack 8	python-Django	1.11.23-3.12.1	SUSE-SU-2019:2257-1
SUSE Enterprise Storage 5	python-Django	1.6.11-6.10.1	SUSE-SU-2019:3127-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	python-Django	3.2.7-2.3	openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1
openSUSE Tumbleweed	python-Django4	4.2.14-1.1	openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1
openSUSE Tumbleweed	python-Django5	5.2.16-1.1	openSUSE-SU-2026:11270-1
openSUSE Tumbleweed	python-Django6	6.0-1.1	openSUSE-SU-2026:10005-1
openSUSE Leap 15.1	python-Django	2.2.4-lp151.2.3.1	openSUSE-SU-2019:1839-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	py3-django	1.11.22-r0	—
Alpine v3.23	py3-django	1.11.22-r0	—
Alpine v3.22	py3-django	1.11.22-r0	—
Alpine v3.21	py3-django	1.11.22-r0	—
Alpine v3.20	py3-django	1.11.22-r0	—

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	py3-django	1.11.22-r0	—
Alpine v3.18	py3-django	1.11.22-r0	—
Alpine v3.17	py3-django	1.11.22-r0	—
Alpine v3.16	py3-django	1.11.22-r0	—
Alpine v3.15	py3-django	1.11.22-r0	—
Alpine v3.14	py3-django	1.11.22-r0	—
Alpine v3.13	py3-django	1.11.22-r0	—
Alpine v3.12	py3-django	1.11.22-r0	—
Alpine v3.11	py3-django	1.11.22-r0	—
Alpine v3.10	py-django	1.11.22-r0	—
Alpine v3.9	py-django	1.11.22-r0	—
Alpine v3.8	py-django	1.11.22-r0	—
Alpine v3.7	py-django	1.11.22-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	django	>= 2.1, < 2.1.10	2.1.10	GHSA-6c7v-2f49-8h26
PyPI	django	>= 2.2, < 2.2.3	2.2.3	GHSA-6c7v-2f49-8h26
PyPI	django	>= 1.11, < 1.11.22	1.11.22	GHSA-6c7v-2f49-8h26
PyPI	django	>= 2.1, < 2.1.10 · >= 2.2, < 2.2.3 · >= 1.11, < 1.11.22	2.1.10, 2.2.3, 1.11.22	PYSEC-2019-10

Advisories 19

RHSA-2020:4366 Red Hat Security Advisory: Satellite 6.8 release Red Hat Security Advisories (RHSA) · Oct 13, 2026
openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
RHSA-2020:4390 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHSA-2020:1324 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
USN-4043-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
DSA-4476-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1842-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:3127-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2019:1872-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:2257-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:2379-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2019:1839-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2019:2335-1 Security update for python-Django1 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026

References

https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ
https://www.djangoproject.com/weblog/2019/jul/01/security-releases/
[oss-security] 20190701 Django: CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS mailing-list
USN-4043-1 vendor-advisory
109018 vdb-entry
https://security.netapp.com/advisory/ntap-20190705-0002/
DSA-4476 vendor-advisory
20190708 [SECURITY] [DSA 4476-1] python-django security update mailing-list
FEDORA-2019-d9aa58d863 vendor-advisory
openSUSE-SU-2019:1839 vendor-advisory
openSUSE-SU-2019:1872 vendor-advisory