The JForum2 Project is proud to announce the release of version 2.3.5 of JForum. This release includes bug fixes and new features compared to version 2.3.4.

You can download the latest war file from the following URL, then deploy it to your Tomcat's webapps directory:
http://code.google.com/p/jforum2/downloads/list
If your Tomcat doesn't unpack the war file automatically, you'll need to unpack it manually, then restart your Tomcat.

A partial list of the new and enhanced features in this release can be found here.

I didnt see it in the release notes but does this release fix the cross site request forgery issues that jForum suffers from as described here: http://www.selikoff.net/2013/02/09/csrf-jforum-cleanup-and-problems/

And if not, is there any estimate when these will be fixed. Potential users should be made aware of this huge security hole.

A fix for that was not part of the release, and there is currently no ETA for a fix.