Scott Barron and Tobias Luetke, of the Ruby on Rails Core Team, discovered a fault with the dependency resolution mechanism which can, when exploited by a remote attacker, leave a system vulnerable to denial of service attacks, or even data loss. Affected are versions 1.1.0 through 1.1.5.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/49263/rubyonrails.txt
Source: https://packetstormsecurity.com/files/49263/rubyonrails.txt.html