G5/g5-content-management-system — pull request #436 by bbauer (2014-08-18 20:48:14+00:00)
Title: Bump rails to 4.1.5

The createwith functionality in Active Record was implemented incorrectly and
completely bypasses the strong parameters protection. Applications which pass
user-controlled values to createwith could allow attackers to set arbitrary
attributes on models.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Affected versions: 4.0.0 and All Later Versions
Not affected: Versions earlier than 4.0.0, and greater than or equal to 4.0.9
and 4.1.5
Fixed versions: 4.0.9, 4.1.5
Identifier: CVE-2014-3514