For all those who can't upgrade to the latest versions of Rails: Zweitag (my employer) maintains a Rails fork with security fixes applied to all Rails releases since 3.1.0.

https://github.com/zweitag/rails/branches