What is GHSA-r82c-j4mq-5xfw?

GHSA-r82c-j4mq-5xfw is a security advisory published by GitHub Security Advisories with High severity. Update bitlyshortener to \u003e=0.5.0 to prevent generating some invalid short URLs

Why does GHSA-r82c-j4mq-5xfw have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-r82c-j4mq-5xfw?

GHSA-r82c-j4mq-5xfw affects 1 product, including: pip/bitlyshortener:\u003c 0.5.0.

GHSA-r82c-j4mq-5xfwHighDisclosed before NVD

Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs

Vendor

GitHub Security Advisories

Published

October 27, 2020

Last Modified

January 9, 2023

📋 Description

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.5.0 can generate an invalid short URL when a vanity domain exists.

Patches

Upgrading bitlyshortener to 0.5.0 or newer will prevent the generation of any such invalid short URLs.

References

Release notes

🎯 Affected products1

pip/bitlyshortener:< 0.5.0

🔗 References (5)

https://github.com/impredicative/bitlyshortener/security/advisories/GHSA-r82c-j4mq-5xfw
https://github.com/impredicative/bitlyshortener/commit/3d412feb77f3daf6f71536463734c2119a55968d
https://github.com/impredicative/bitlyshortener/releases/tag/0.5.0
https://pypi.org/project/bitlyshortener/
https://github.com/advisories/GHSA-r82c-j4mq-5xfw