activesupport 2.x is not affected by CVE-2012-1098.

* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1098