Rails Security Team now states that 2.x and 3.x were affected!

* https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/c7jT-EeN9eI