Skip to content

Invalid URL generation in bitlyshortener

Moderate severity GitHub Reviewed Published Jan 19, 2022 in impredicative/bitlyshortener • Updated Jan 11, 2023

Package

pip bitlyshortener (pip)

Affected versions

< 0.6.0

Patched versions

0.6.0

Description

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

Patches

Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs.

Workarounds

A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

References

References

@impredicative impredicative published to impredicative/bitlyshortener Jan 19, 2022
Reviewed Jan 20, 2022
Published to the GitHub Advisory Database Jan 21, 2022
Last updated Jan 11, 2023

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-rcrv-228c-gprj

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.