CVE 2012-2661 had the wrong constraint for unaffected versions. The announcement (https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/dUaiOOGWL1k) states that 2.3.14 is unaffected, which indicates that the version constraint should be ~> "2.3.14"