Upgrade to Rails 2.3.18 to get fixes for CVE-2013-1855, CVE-2013-1856, CVE-2013-1857.