Skip to content
Fencer Intel
medium —

GHSA-rcrv-228c-gprj json

Invalid URL generation in bitlyshortener

published 4y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

### Patches Upgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.

### Workarounds A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

### References * [Release notes](https://github.com/impredicative/bitlyshortener/releases)

Patch / fix

  • pypi bitlyshortener 0.6.0

Is GHSA-rcrv-228c-gprj in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi bitlyshortener
<0.6.0
0.6.0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.