This update fixes CVE-2015-8213: Fixed settings leak possibility in date template filter, more info can be found https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2015-a8c8f60fbdPlease login to add feedback.
This update has been submitted for testing by mrunge.
This update has been pushed to testing.
I cannot reproduce the security flaw. I wrote a template containing only : { foo|date:bar }} and redered it with: render(request, 'test.html', {'foo':datetime.date.today(), 'bar':'"SECRET_KEY"'}) But with Django 1.8.4 and with Django 1.8.7 I get the same desired result. So no karma for the fixes but for the release.
This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes
This update has been submitted for stable by bodhi.
No regressions... Works for me.
This update has been pushed to stable.