There were also a few other Rails CVEs announced today as well:

CSRF Vulnerability in jquery-ujs / jquery-rails: https://groups.google.com/forum/#!topic/rubyonrails-security...

XSS in ActiveSupport::JSON.encode: https://groups.google.com/forum/#!topic/rubyonrails-security...

IP Whitelist Bypass in Web Console: https://groups.google.com/forum/#!topic/rubyonrails-security...