Just in case you guys hadn't heard about it: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/61bkgvnSGTQ

This is considered an urgent fix.