http://www.djangoproject.com/weblog/2010/sep/08/security-release/
All users of Django 1.2 are urged to upgrade immediately.
-- "Bureaucrat Conrad, you are technically correct -- the best kind of correct."