What is GHSA-rcrv-228c-gprj?

GHSA-rcrv-228c-gprj is a security advisory published by GitHub Security Advisories with Medium severity. Invalid URL generation in bitlyshortener

Why does GHSA-rcrv-228c-gprj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-rcrv-228c-gprj?

GHSA-rcrv-228c-gprj affects 1 product, including: pip/bitlyshortener:\u003c 0.6.0.

GHSA-rcrv-228c-gprjMediumDisclosed before NVD

Invalid URL generation in bitlyshortener

Vendor

GitHub Security Advisories

Published

January 21, 2022

Last Modified

January 11, 2023

📋 Description

Impact

Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

Patches

Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs.

Workarounds

A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

References

Release notes

🎯 Affected products1

pip/bitlyshortener:< 0.6.0

🔗 References (4)

https://github.com/impredicative/bitlyshortener/security/advisories/GHSA-rcrv-228c-gprj
https://github.com/impredicative/bitlyshortener/commit/b307d70bedf745305fa0dd3c5c600d8cb88d09b5
https://github.com/impredicative/bitlyshortener/releases/tag/0.6.0
https://github.com/advisories/GHSA-rcrv-228c-gprj