We are urgently updated to Ruby on Rails 3.2.12, 3.1.11 and 2.3.17 for the benefit of our own nerves

Good day, dear reader. I hope that you are reading this short post for your morning coffee, and you did not have to create an extra deployment in the middle of the night. Otherwise, condolence, and I suggest you update your Ruby on Rails applications right now.

You can see what has changed on github:

• 3.2.x -> 3.2.12 ( vulnerability in attr_protected )
• 3.1.x -> 3.1.11 (same vulnerability in attr_protected and another vulnerability in YAML )
• 2.3.x -> 2.3.17 (YAML, attr_protected)

In addition to the patches of the framework itself, the team recommends updating the JSON gems, today's release of which contains equally important fixes . In detail, the situation described chikey .

Since the beginning of this year, the vulnerability in the rail did not have time to find only lazy . But this activity is not so much saddening as it pleases - because it indicates the maturing of the framework. Do not forget to follow the Google group , and also say thanks to people who find vulnerabilities and fix them.
')
A subjectively useful reading recommended by me:

• Rails Vulnerabilities: Learning The Lesson via @homakov