1.2.4 was released the other day. At the least, it addresses security bug #182223. I would do it myself, but my development box is a little dead at the moment.
I'm on it, should be landing in the tree this weekend.
Rails 1.2.4 and its dependencies are now in the tree.