Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/51270?format=api",
    "purl": "pkg:gem/activerecord@3.1.5",
    "type": "gem",
    "namespace": "",
    "name": "activerecord",
    "version": "3.1.5",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "3.1.6",
    "latest_non_vulnerable_version": "7.0.4.1",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37443?format=api",
            "vulnerability_id": "VCID-cce9-3g2x-h3dt",
            "summary": "SQL injection vulnerability in Active Record\nDue to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.",
            "references": [
                {
                    "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2661",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2661"
                },
                {
                    "reference_url": "https://github.com/rails/rails/commit/71f7917c553cdc9a0ee49e87af0efb7429759718#diff-2ec9993375ecb711e08452788d625581",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rails/rails/commit/71f7917c553cdc9a0ee49e87af0efb7429759718#diff-2ec9993375ecb711e08452788d625581"
                },
                {
                    "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82403.yml",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82403.yml"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51269?format=api",
                    "purl": "pkg:gem/activerecord@3.0.13",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.0.13"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51270?format=api",
                    "purl": "pkg:gem/activerecord@3.1.5",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.1.5"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51271?format=api",
                    "purl": "pkg:gem/activerecord@3.2.4",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.2.4"
                }
            ],
            "aliases": [
                "CVE-2012-2661"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cce9-3g2x-h3dt"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37442?format=api",
            "vulnerability_id": "VCID-p6yg-d8wm-4bgz",
            "summary": "SQL Injection\nRuby on Rails contains a flaw related to the way ActiveRecord handles parameters in conjunction with the way Rack parses query parameters. This issue may allow an attacker to inject arbitrary `IS NULL` clauses in to application SQL queries. This may also allow an attacker to have the SQL query check for `NULL` in arbitrary places.",
            "references": [
                {
                    "reference_url": "https://github.com/rails/rails",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rails/rails"
                },
                {
                    "reference_url": "https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b"
                },
                {
                    "reference_url": "https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rails/rails/commit/dff6db18840e2fd1dd3f3e4ef0ae7a9a3986d01d#diff-3179d24efacadd64068c4d9c1184eac3"
                },
                {
                    "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-82610.yml"
                },
                {
                    "reference_url": "https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://groups.google.com/forum/#!original/rubyonrails-security/8SA-M3as7A8/Mr9fi9X4kNgJ"
                },
                {
                    "reference_url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"
                },
                {
                    "reference_url": "https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660",
                    "reference_id": "CVE-2012-2660",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660"
                },
                {
                    "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml",
                    "reference_id": "CVE-2012-2660.YML",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml"
                },
                {
                    "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml",
                    "reference_id": "CVE-2012-2660.YML",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-hgpp-pp89-4fgf",
                    "reference_id": "GHSA-hgpp-pp89-4fgf",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-hgpp-pp89-4fgf"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51269?format=api",
                    "purl": "pkg:gem/activerecord@3.0.13",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.0.13"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51270?format=api",
                    "purl": "pkg:gem/activerecord@3.1.5",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.1.5"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/51271?format=api",
                    "purl": "pkg:gem/activerecord@3.2.4",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.2.4"
                }
            ],
            "aliases": [
                "CVE-2012-2660",
                "GHSA-hgpp-pp89-4fgf"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p6yg-d8wm-4bgz"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/activerecord@3.1.5"
}