I am not sure it has actually been announced on the relevant mailing list - https://groups.google.com/forum/#!forum/ruby-security-ann