CVE-2019-12781: canonical ubuntu_linux
Vulnerability summary
CVE-2019-12781 is a medium (CVSS 5.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.71% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 17 · Related 13Timeline
- 01-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.71%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.71% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- py-django< 1.11.22-r0
- py3-django< 1.11.22-r0
Debian2 products
- python-django< 1:1.11.22-1 | < 1.7.11-1+deb8u6
- debian_linuxEOL9.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10 | 19.04
Djangoproject1 product
- django≥ 1.11, < 1.11.22 | ≥ 2.1, < 2.1.10 | ≥ 2.2, < 2.2.3
PyPI1 product
- django≥ 2.1, < 2.1.10 | ≥ 2.2, < 2.2.3 | ≥ 1.11, < 1.11.22
Suse1 product
- python-Django&distro=SUSE OpenStack Cloud 7< 1.8.19-3.18.1
Ubuntu1 product
- python-djangoAll versions (No fix recorded) | < 1.8.7-1ubuntu5.9 | < 1:1.11.11-1ubuntu1.4
7 vendors · 9 products
References
31 links- groups.google.com/forum/X Refsource MISC
- www.djangoproject.com/weblog/2019/jul/01/security-releases/X Refsource CONFIRMPatchVendor AdvisoryARTICLE
- www.openwall.com/lists/oss-security/2019/07/01/3Mailing ListX Refsource MLISTPatchThird Party AdvisoryWEB
www.debian.org/security/2019/dsa-4476Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEBAdvisory
Show all 31 references
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlVendor AdvisoryX Refsource SUSEWEB
- github.com/django/djangoPACKAGE