According to the Rails Advisory, all 2.x versions not affected.

* https://groups.google.com/forum/m/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI