Please note the vulnerability has now been amended. "There are additional attack vectors and as a result all users are advised to upgrade to a fixed version as soon as possible."

https://groups.google.com/forum/#!topic/rubyonrails-security...