{"url":"http://public2.vulnerablecode.io/api/packages/57008?format=json","purl":"pkg:gem/rack@2.0.6","type":"gem","namespace":"","name":"rack","version":"2.0.6","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"2.0.9.2","latest_non_vulnerable_version":"3.2.5","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/40437?format=json","vulnerability_id":"VCID-1ra1-pgt2-3ubf","summary":"Cross-site Scripting\nThere is a possible XSS vulnerability in Rack. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to HTTP or HTTPS and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not be impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","references":[{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16471","reference_id":"CVE-2018-16471","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16471"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57020?format=json","purl":"pkg:gem/rack@1.6.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.6.11"},{"url":"http://public2.vulnerablecode.io/api/packages/57008?format=json","purl":"pkg:gem/rack@2.0.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.0.6"}],"aliases":["CVE-2018-16471"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1ra1-pgt2-3ubf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/40435?format=json","vulnerability_id":"VCID-6zct-y89u-2bag","summary":"Uncontrolled Resource Consumption\nThere is a possible DoS vulnerability in the multipart parser in Rack. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.","references":[{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16470","reference_id":"CVE-2018-16470","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16470"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57008?format=json","purl":"pkg:gem/rack@2.0.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.0.6"}],"aliases":["CVE-2018-16470"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6zct-y89u-2bag"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.0.6"}