Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs

published 2020-10-27 6y ago modified 2024-12-02 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.5.0 can generate an invalid short URL when a vanity domain exists.

### Patches Upgrading `bitlyshortener` to 0.5.0 or newer will prevent the generation of any such invalid short URLs.

### References * [Release notes](https://github.com/impredicative/bitlyshortener/releases)

Patch / fix

fixed in 1 links 2

pypi bitlyshortener 0.5.0

Is GHSA-r82c-j4mq-5xfw in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	bitlyshortener	<0.5.0	0.5.0

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

Sources

GitHub Advisory GHSA-r82c-j4mq-5xfw

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.