There's actually two vulnerability announcements: https://groups.google.com/foru...

		danso on Jan 8, 2013 \| parent \| context \| favorite \| on: Multiple vulnerabilities in parameter parsing in A... There's actually two vulnerability announcements: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... This one deals with problematic JSON parsing and affects only 3.x. It is dealt with in the release that fixes the other vulnerability