Via pre-notification:

You're receiving this message because you are on the security
pre-notification list for the Django web framework; information about
this list can be found in our security policy [1].

In accordance with that policy, on Tuesday, November 24, 2015 around
17:00 UTC, the Django project will be issuing a release to remedy a
security issue reported to us. This message contains a description of
the issue, a description of the changes which will be made to Django,
and the patches which will be applied to Django.

CVE-2015-8213: Settings leak possibility in ``date`` template filter
====================================================================

If an application allows users to specify an unvalidated format for
dates and passes this format to the ``date`` filter, e.g.
``{{ last_updated|date:user_date_format }}``, then a malicious user
could obtain any secret in the application's settings by specifying a
settings key instead of a date format. e.g. ``"SECRET_KEY"`` instead
of ``"j/m/Y"``.

To remedy this, the underlying function used by the ``date`` template
filter, ``django.utils.formats.get_format()``, now only allows
accessing the date/time formatting settings.

Affected supported versions
===========================

* Django master development branch
* Django 1.9
* Django 1.8
* Django 1.7

Per our supported versions policy [2], Django 1.6 and older are no
longer receiving security updates.
Resolution
==========

Included with this email are patches implementing the changes
described above for each affected version of Django. These patches
will be applied to the Django development repository on the release
date above and the following releases will be issued along with
disclosure of the issues:

* Django 1.9 release candidate 2
* Django 1.8.7
* Django 1.7.11

As Django's master development branch is in a pre-alpha state, users are
strongly encouraged not to run production deployments from it; the
disclosure announcement will nonetheless include a reminder of this
and encourage any such users to upgrade immediately.

[1] https://www.djangoproject.com/security/
[2]
https://docs.djangoproject.com/en/dev/internals/release-process/#support
ed-versions