Use the conversions.rb patch for 2.x from https://groups.google.com/forum/#!topic/rubyonrails-security...
"We're not patching it" statement: https://launchpad.net/bugs/320813
Re. bundler/gems, I don't know what those are - the file "core_ext/hash/conversions.rb" I hand-patched was from a package called ruby-activesupport-2.3 which is a dependency of the Rails package.
I think if 100% of your eco system is from the package manager you would be fine, but if even a single component needs to come from outside I would reach straight for rvm and bundler (no prejudice against rbenv, rvm is just what I use)
That's not what was said. They don't maintain it.