GitHub Advisoryadvisory · PyPI
GHSA-r82c-j4mq-5xfw Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs
HIGH
Official page ↗
- Ecosystem
- PyPI
- Packages
- bitlyshortener
- Severity
- High
- Weaknesses
- CWE-601
- Reviewed
- 2020-10-27
Affected packages
• PyPI bitlyshortener: < 0.5.0 → fixed in 0.5.0
Description
Impact
Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.5.0 can generate an invalid short URL when a vanity domain exists.
Patches
Upgrading `bitlyshortener` to 0.5.0 or newer will prevent the generation of any such invalid short URLs.
References
• Release notes
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/impredicative/bitlyshortener/security/advisories/GHSA-r82c-j4mq-5xfw web
- https://github.com/impredicative/bitlyshortener/commit/3d412feb77f3daf6f71536463734c2119a55968d web
- https://github.com/impredicative/bitlyshortener/releases/tag/0.5.0 web
- https://pypi.org/project/bitlyshortener web