Older than 2.3? http://weblog.rubyonrails.org/
http://www.insinuator.net/2013/01/rails-yaml/
From the comments:
"From what i’ve see here is that versions below 2.0 should not be affected by this issue as they do not support xml parameters and don’t have any XMLMini implementations."