MEDIUM

GHSA-rcrv-228c-gprj

Invalid URL generation in bitlyshortener

Quick fix

GHSA-rcrv-228c-gprj — bitlyshortener: upgrade to the fixed version with the command below.

pip install --upgrade 'bitlyshortener>=0.6.0'

Details

### Impact Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

### Patches Upgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.

### Workarounds A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

### References * [Release notes](https://github.com/impredicative/bitlyshortener/releases)

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/bitlyshortener

Introduced in: 0Fixed in: 0.6.0

Fixpip install --upgrade 'bitlyshortener>=0.6.0'

References

https://github.com/impredicative/bitlyshortener/security/advisories/GHSA-rcrv-228c-gprj[WEB]
https://github.com/impredicative/bitlyshortener/commit/b307d70bedf745305fa0dd3c5c600d8cb88d09b5[WEB]
https://github.com/impredicative/bitlyshortener[PACKAGE]
https://github.com/impredicative/bitlyshortener/releases/tag/0.6.0[WEB]