aswin1906/github-advisory-2020.csv huggingface dataset:
IDOR can reveal execution data and logs to unauthorized user in Rundeck
Advisory: GHSA-5679-7qrc-5m7j (CVE-2020-11009)
Published: 2020-04-29T16:31:12Z

### Impact

Authenticated users can craft a request that reveals Execution data and logs  and Job details that they are not authorized to see.

> Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher.

### Details

An authenticated user could craft a request to:

* View Executions and download execution logs without access to `read` or `view` the associated Job, or ad-hoc resource.
* Get the list of running executions in a project, without Event `read` access, if they have `read` access to view the project.
* View the Options definitions of a Job without access to view the Job.
* View the definition of a workflow step of a Job without access to view the Job.
* View the SCM diff of a modified Job definition if SCM is enabled, without Project `export` access level.
* View the New User Profile Form for a different username, without User `admin` access. Note: they would not be allowed to create or modify a profile for a different user, or reveal any user profile information for a different user.

Some authenticated API requests were not correctly checking appropriate authorization levels:

* The list of running Executions would be sent without `read` access to Events.
* The Plugin Input Parameters for a SCM plugin would be sent without authorization for project `import`,`scm_import`,`export`, or `scm_export` actions.
* Job Retry action could retry an execution without `read` or `view` access to the Execution, which would reveal the Execution's option values. (`run` access to the Job was still required).

### Patches
Upgrade to Rundeck version 3.2.6

### Workarounds
None

### References
[3.2.6 Release Notes](https://docs.rundeck.com/docs/history/3_2_x/version-3.2.6.html)

### Report
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [http://rundeck.com/security](http://rundeck.com/security)

Reporter: Justine Osborne of Apple Information Security

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.rundeck:rundeck, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.6
Http request which redirect to another hostname do not strip authorization header in @actions/http-client
Advisory: GHSA-9w6v-m7wp-jwg4 (CVE-2020-11021)
Published: 2020-04-29T17:58:53Z

### Impact
If consumers of the http-client:
  1. make an http request with an authorization header
  2. that request leads to a redirect (302) and
  3. the redirect url redirects to another domain or hostname 

The authorization header will get passed to the other domain.

Note that since this library is for actions, the GITHUB_TOKEN that is available in actions is generated and scoped per job with [these permissions](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#permissions-for-the-github_token).

### Patches
The problem is fixed in 1.0.8 at [npm here](https://www.npmjs.com/package/@actions/http-client).  In 1.0.8, the authorization header is stripped before making the redirected request if the hostname is different.

### Workarounds
None.

### References
https://github.com/actions/http-client/pull/27

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/actions/http-client/issues

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @actions/http-client, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.8
Prototype Pollution in minimist
Advisory: GHSA-vh95-rmgr-6w4m (CVE-2020-7598)
Published: 2020-04-03T21:48:32Z

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application.  
This is exploitable if attackers have control over the arguments being passed to `minimist`.



## Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: minimist, ecosystem_specific: affected_functions: minimist, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.1
package: ecosystem: npm, name: minimist, ecosystem_specific: affected_functions: minimist, ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.2.3
Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Advisory: GHSA-8h56-v53h-5hhj (CVE-2020-10204)
Published: 2020-04-14T15:27:14Z

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.sonatype.nexus:nexus-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.21.2
Depth counting error in guard() leading to multiple potential security issues in aioxmpp
Advisory: GHSA-6m9g-jr8c-cqw3 (CVE-2019-1000007)
Published: 2020-04-29T17:12:39Z

### Impact
Possible remote Denial of Service or Data Injection.

### Patches
Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix.

### Workarounds
To make the bug exploitable, an error suppressing ``xso_error_handler`` is required. By not using ``xso_error_handlers`` or not using the suppression function, the vulnerability can be mitigated completely (to our knowledge).

### References
The pull request contains a detailed description: https://github.com/horazont/aioxmpp/pull/268

### For more information
If you have any questions or comments about this advisory:
* [Join our chat](xmpp:aioxmpp@conference.zombofant.net?join)
* Email the maintainer [Jonas Schäfer](mailto:jonas@wielicki.name)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: aioxmpp, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10.3
Nexus Repository Manager 3 - Remote Code Execution 
Advisory: GHSA-g2f6-v5qh-h2mq (CVE-2020-10199)
Published: 2020-04-14T15:27:05Z

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.sonatype.nexus:nexus-extdirect, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.21.2
Information disclosure of source code in SimpleSAMLphp
Advisory: GHSA-24m3-w8g9-jwpq (CVE-2020-5301)
Published: 2020-04-22T20:59:44Z

### Background

The module controller in `SimpleSAML\Module` that processes requests for pages
hosted by modules, has code to identify paths ending with `.php` and process
those as PHP code. If no other suitable way of handling the given path exists it
presents the file to the browser.

### Description

The check to identify paths ending with `.php` does not account for uppercase
letters. If someone requests a path ending with e.g. `.PHP` and the server is
serving the code from a case-insensitive file system, such as on Windows, the
processing of the PHP code does not occur, and the source code is instead
presented to the browser.

### Affected versions

SimpleSAMLphp versions **1.18.5 and older**.

### Impact

An attacker may use this issue to gain access to the source code in third-party
modules that is meant to be private, or even sensitive. However, the attack
surface is considered small, as the attack will only work when SimpleSAMLphp
serves such content from a file system that is not case-sensitive, such as on
Windows.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.6**.

### Credit

This vulnerability was discovered and reported by Sławek Naczyński.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: simplesamlphp/simplesamlphp, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.18.6
SQL injection in Tortoise ORM
Advisory: GHSA-9j2c-x8qm-qmjq (CVE-2020-11010)
Published: 2020-04-20T21:31:23Z

### Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)


### Patches
Please upgrade to 0.15.23+ or 0.16.6+

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/tortoise/tortoise-orm/issues)
* Chat to us on [Gitter](https://gitter.im/tortoise/community)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: PyPI, name: tortoise-orm, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.15.23
package: ecosystem: PyPI, name: tortoise-orm, ranges: type: ECOSYSTEM, events: introduced: 0.16.0
fixed: 0.16.6
Predictable password in Keycloak
Advisory: GHSA-6pmv-7pr9-cgrj (CVE-2020-1731)
Published: 2020-04-15T21:09:27Z

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.keycloak:keycloak-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.0.2
Persistent Cross-Site scripting in Nexus Repository Manager
Advisory: GHSA-3944-787c-f852 (CVE-2020-10203)
Published: 2020-04-14T15:27:21Z

Sonatype Nexus Repository before 3.21.2 allows XSS.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.sonatype.nexus:nexus-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.21.2
File restriction bypass in socket.io-file
Advisory: GHSA-6495-8jvh-f28x ()
Published: 2020-10-02T15:39:54Z

All versions of `socket.io-file`are vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the `name` value to upload any file types.

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: socket.io-file, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.0.31
RCE in XWiki
Advisory: GHSA-5hv6-mh8q-q9v8 (CVE-2020-15252)
Published: 2020-10-16T16:55:49Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.5 and XWiki 11.10.6.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17423

It's been reported by the GitHub Security Lab under https://jira.xwiki.org/browse/XWIKI-17141.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.xwiki.platform:xwiki-platform-oldcore, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.10.6
package: ecosystem: Maven, name: org.xwiki.platform:xwiki-platform-oldcore, ranges: type: ECOSYSTEM, events: introduced: 12.0
fixed: 12.5
Potential Remote Code Execution vulnerability
Advisory: GHSA-8gv3-3j7f-wg94 (CVE-2020-15227)
Published: 2020-10-02T16:22:19Z

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. 

Reported by Cyku Hong from DEVCORE (https://devco.re)

### Impact
Code injection, possible remote code execution.

### Patches
Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.10
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.14
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 2.4.0
fixed: 2.4.16
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.6
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.19
package: ecosystem: Packagist, name: nette/application, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.13
Possible timing attack in derivation_endpoint
Advisory: GHSA-5jjv-x4fq-qjwp (CVE-2020-15237)
Published: 2020-10-05T15:48:34Z

### Impact

When using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL.

### Patches

The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater.

### Workarounds

Users of older Shrine versions can apply the following monkey-patch after loading the `derivation_endpoint` plugin:

```rb
class Shrine
  class UrlSigner
    def verify_signature(string, signature)
      if signature.nil?
        fail InvalidSignature, "missing \"signature\" param"
      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
        fail InvalidSignature, "provided signature does not match the calculated signature"
      end
    end
  end
end
```

### References

You can read more about timing attacks [here](https://en.wikipedia.org/wiki/Timing_attack).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: shrine, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.3.0
Denial of Service via Cache Flooding
Advisory: GHSA-p68v-frgx-4rjp ()
Published: 2020-10-19T21:34:14Z

### Impact
 Denial of Service via Cache Flooding

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.2.1, database_specific: last_known_affected_version_range: <= 6.3.2.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.2.1, database_specific: last_known_affected_version_range: <= 6.3.2.0
Sensitive data exposure in NATS
Advisory: GHSA-82rf-q3pr-4f6p (CVE-2020-26149)
Published: 2020-10-08T22:11:32Z

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

The `_connection_` configuration options in these JavaScript-based implementations were fully serialized and sent to the server in the client's CONNECT message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS client key are included in the connection configuration options; disclosure of the client's TLS private key to the server has been observed.

Most authentication mechanisms are handled after connection, instead of as part of connection, so other authentication mechanisms are unaffected. For clarity: NATS account NKey authentication is NOT affected.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the affected versions listed below are those where the logic flaw is present. We are including the nats.ws and nats.deno versions out of an abundance of caution, as library maintainers, but rate as minimal the likelihood of applications leaking sensitive data.

### Security impact:

* NPM package nats.js:
+ mainline is unaffected
+ beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

### Logic flaw:

* NPM package nats.ws:
+ status: preview
+ flawed from 1.0.0-85, fixed in 1.0.0-111
* Deno repository https://github.com/nats-io/nats.deno
+ status: preview
+ flawed in all git tags prior to fix
+ fixed with git tag v1.0.0-9

### Impact:

For deployments using TLS client certificates (for mutual TLS), private key material for TLS is leaked from the client application to the server. If the server is untrusted (run by a third party), or if the client application also disables TLS verification (and so the true identity of the server is unverifiable) then authentication credentials are leaked.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: nats, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0-201
fixed: 2.0.0-209, database_specific: last_known_affected_version_range: <= 2.0.0-206
package: ecosystem: npm, name: nats.ws, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.0-85
fixed: 1.0.0-111, database_specific: last_known_affected_version_range: <= 1.0.0-110
Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0
Advisory: GHSA-6fmv-q269-55cw (CVE-2020-15277)
Published: 2020-10-30T17:05:59Z

baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit template.
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.1
Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Advisory: GHSA-8hxh-r6f7-jf45 ()
Published: 2020-10-16T17:03:43Z

### Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM.  It does not affect http4s servers, other client backends, or clients that speak only to trusted servers.  This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by [CVE-2020-11612](https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897).

### Patches
Upgrade to http4s-async-http-client >= 0.21.8.  All 1.0 milestones are also safe.

### Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:

```scala
libraryDependencies ++= Seq(
  "io.netty" %  "netty-codec"         % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-codec-socks"   % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler-proxy" % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-common"        % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-transport"     % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler"       % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-resolver-dns"  % "4.1.53.Final" % Runtime
)
```

### References
* https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897
* https://github.com/http4s/http4s/issues/3681

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s](https://github.com/http4s/http4s/issues/new)
* Contact a maintainer privately per [http4s' security policy](https://github.com/http4s/http4s/blob/master/SECURITY.md#reporting-a-vulnerability)

Affected packages:
package: ecosystem: Maven, name: org.http4s:http4s-async-http-client_2.13, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.21.8, database_specific: last_known_affected_version_range: <= 0.21.7
package: ecosystem: Maven, name: org.http4s:http4s-async-http-client_2.12, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.21.8, database_specific: last_known_affected_version_range: <= 0.21.7
Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Advisory: GHSA-fw5q-j9p4-3vxg (CVE-2020-15276)
Published: 2020-10-30T19:10:20Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Components are: Blog comment posting
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by yama

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.1
CLI does not correctly implement strict mode
Advisory: GHSA-2xwp-m7mq-7q3r ()
Published: 2020-10-28T17:05:38Z

In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."

Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.

Affected packages:
package: ecosystem: PyPI, name: aws-encryption-sdk-cli, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.8.0
package: ecosystem: PyPI, name: aws-encryption-sdk-cli, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.1.0
Man-in-the-middle attack in Apache Axis
Advisory: GHSA-55w9-c3g2-4rrh (CVE-2012-5784)
Published: 2020-10-07T17:51:02Z

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected packages:
package: ecosystem: Maven, name: org.apache.axis:axis, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.4
package: ecosystem: Maven, name: axis:axis, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.4
Open Redirect in Next.js versions
Advisory: GHSA-x56p-c8cg-q435 (CVE-2020-15242)
Published: 2020-10-08T19:28:07Z

### Impact

- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 
- **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected
- **Not affected**: Deployments using `next export`

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

### References

https://github.com/vercel/next.js/releases/tag/v9.5.4



Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: next, ranges: type: ECOSYSTEM, events: introduced: 9.5.0
fixed: 9.5.4
RCE via PHP Object injection via SOAP Requests
Advisory: GHSA-jrgf-vfw2-hj26 (CVE-2020-15244)
Published: 2020-10-30T17:06:06Z

### Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

### Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

### Credits
Credit to Luke Rodgers for reporting

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: openmage/magento-lts, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 19.4.8
package: ecosystem: Packagist, name: openmage/magento-lts, ranges: type: ECOSYSTEM, events: introduced: 20.0.0
fixed: 20.0.4
xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion
Advisory: GHSA-c27r-x354-4m68 ()
Published: 2020-10-27T20:39:46Z

### Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.

### Patches
Version 2.0.0 has the fix.

### Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.

Affected packages:
package: ecosystem: npm, name: xml-crypto, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0, database_specific: last_known_affected_version_range: <= 1.5.3
Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration
Advisory: GHSA-f366-4rvv-95x2 ()
Published: 2020-10-02T16:33:19Z

### Impact
1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c).

2) The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be written to the stack.

### Patches
USB kit enumeration has been patched in v3.2.3 for the hidapi HAL (hal_all_platforms_kit_hidapi.c).

### Removal of deprecated HALs
Deprecated usb kit HALs have been removed in v3.2.3.

### Workarounds
This vulnerability is limited to users of the kit protocol which is used with Microchip kits and kit firmware to bridge communication from USB-HID to I2C or SWI. It is not expected that kits would be used in an production environment. This is an optional component for users as well so they can always compile the library without the usb support option.

### Special python packaging notes
The python package for cryptoauthlib uses date codes for identifying versions. The patched version for python packages is 20200912

### References
Please see [Microchip PSIRT](https://www.microchip.com/design-centers/embedded-security/how-to-report-potential-product-security-vulnerabilities) for Microchip's security policy and reporting procedures

### Credits
Special thanks to Ruben Santamarta of [IOActive](https://blogs.ioactive.com/) for reporting

Affected packages:
package: ecosystem: PyPI, name: cryptoauthlib, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 20200912
Unpreventable top-level navigation
Advisory: GHSA-2q4g-w47c-4674 (CVE-2020-15174)
Published: 2020-10-06T14:24:04Z

### Impact
The `will-navigate` event that apps use to prevent navigations to unexpected destinations [as per our security recommendations](https://www.electronjs.org/docs/tutorial/security) can be bypassed when a sub-frame performs a top-frame navigation across sites.

### Patches

* `11.0.0-beta.1`
* `10.0.1`
* `9.3.0`
* `8.5.1`

### Workarounds
Sandbox all your iframes using the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox).  This will prevent them creating top-frame navigations and is good practice anyway.

### For more information
If you have any questions or comments about this advisory:

* Email us at security@electronjs.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0-beta.0
fixed: 8.5.1
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 9.0.0-beta.0
fixed: 9.3.0
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 10.0.0-beta.0
fixed: 10.0.1
Cross-site Scripting in Strapi
Advisory: GHSA-qvp5-mm7v-4f36 (CVE-2020-27666)
Published: 2020-10-29T19:40:08Z

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: strapi-plugin-content-manager, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.5
RSA decryption vulnerable to Bleichenbacher timing vulnerability
Advisory: GHSA-hggm-jpg3-v476 (CVE-2020-25659)
Published: 2020-10-27T20:33:13Z

RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2. 

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: cryptography, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2
Unauthorized privilege escalation in Mod module
Advisory: GHSA-mp9m-g7qj-6vqr ()
Published: 2020-10-27T20:30:48Z

### Impact
An unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it's possible to perform destructive actions within the guild the user has high privileges in.

### Patches
This exploit has been fixed on version & ``3.4.1``.

### Workarounds
Unloading the Mod module with ``unload mod`` __or__, disabling the ``massban`` command with ``command disable global massban`` can render this exploit not accessible. We still highly recommend updating to ``3.4.1`` to completely patch this issue.

### References
* https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)

Affected packages:
package: ecosystem: PyPI, name: red-discordbot, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.4.1
Ability to switch customer email address on account detail page and stay verified
Advisory: GHSA-6gw4-x63h-5499 (CVE-2020-15245)
Published: 2020-10-19T20:40:59Z

### Impact
The user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).

### Patches
Patch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.

### Workarounds
If for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.

### Acknowledgements

This security issue has been reported by Mircea Silviu (@decemvre), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.9
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.7.0
fixed: 1.7.9
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.8.0
fixed: 1.8.3
Android WebView Universal Cross-site Scripting
Advisory: GHSA-36j3-xxf7-4pqg (CVE-2020-6506)
Published: 2020-10-02T16:22:41Z

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a `react-native-webview` that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

## Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

### References

https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/



Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: react-native-webview, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.0.0, database_specific: last_known_affected_version_range: <= 10.10.2
Context isolation bypass in Electron
Advisory: GHSA-56pc-6jqp-xqj8 (CVE-2020-15215)
Published: 2020-10-06T17:46:40Z

### Impact
Apps using both `contextIsolation` and `sandbox: true` are affected.
Apps using both `contextIsolation` and `nativeWindowOpen: true` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `11.0.0-beta.6`
* `10.1.2`
* `9.3.1`
* `8.5.2`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0-beta.0
fixed: 8.5.2
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 9.0.0-beta.0
fixed: 9.3.1
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 10.0.0-beta.0
fixed: 10.1.2
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 11.0.0-beta.0
fixed: 11.0.0-beta.6, database_specific: last_known_affected_version_range: <= 11.0.0-beta.5
Unprotected dynamically loaded chunks
Advisory: GHSA-4fc4-chg7-h8gh (CVE-2020-15262)
Published: 2020-10-19T20:02:44Z

### Impact

All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.

### Patches

This issue is patched in version 1.5.1.

### Workarounds

N/A

### References

https://github.com/waysact/webpack-subresource-integrity/issues/131

### For more information
If you have any questions or comments about this advisory:
* Comment on [webpack-subresource-integrity issue #131](https://github.com/waysact/webpack-subresource-integrity/issues/131)
* Or email us at [security@waysact.com](mailto:security@waysact.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: webpack-subresource-integrity, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.1
Privilege Escalation in Channelmgnt plug-in for Sopel
Advisory: GHSA-j257-jfvv-h3x5 (CVE-2020-15251)
Published: 2020-10-13T17:30:30Z

### Impact
Malicious users are able to op/voice and take over a channel

### Patches
On version 1.0.3

### Workarounds
Disable channelmgnt

### References
https://phab.bots.miraheze.wiki/T117

### For more information
If you have any questions or comments about this advisory:
* Email us at [staff(at)mirahezebots(dot)org](mailto:staff@mirahezebots.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: sopel_plugins.channelmgnt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.3
Malicious code in `electorn`
Advisory: GHSA-38hx-3542-8fh3 ()
Published: 2020-10-01T17:09:56Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.

Affected packages:
package: ecosystem: npm, name: electorn, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 10.0.0
Command Injection in systeminformation
Advisory: GHSA-fj59-f6c3-3vw4 (CVE-2020-26300)
Published: 2020-10-27T20:40:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()`

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: systeminformation, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.26.2
receiving subscription objects with deleted session
Advisory: GHSA-2xm2-xj2q-qgpj (CVE-2020-15270)
Published: 2020-10-27T19:15:19Z

Original Message:
Hi,

I create objects with one client with an ACL of all users with a specific column value. Thats working so far.

Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them.
The client with the deleted session cant create new objects, which Parse restricts right.

The LiveQueryServer doesnt detect deleted sessions after the websocket connection was established.
There should be a mechanism that checks in an specific interval if the session exists.
I dont know if its true with expired sessions.

Any solutions?

Parse version: 4.3.0
Parse js SDK version: 2.17

Solution:
Hi guys.

I've found and fixed the problem. It happens because there are two caches in place for the session token:

- at Parse Server level, which, according with the docs, should be changed via cacheTTL option and defaults to 5 seconds;
- at Parse Live Query level, which, according with the docs, should be changed via liveQueryServerOptions.cacheTimeout and defaults to 30 days.

But there are three problems:

- cacheTTL has currently no effect over Live Query Server;
- cacheTimeout also has currently no effect over Live Query Server;
- cacheTimeout actually defaults to 1h.

So, currently, if you wait 1 hour after the session token was invalidated, the clients using the old session token are not able to receive the events.

What I did:

- Added a test case for the problem;
- Fixed cacheTTL for Live Query Server;
- Fixed cacheTimeout for Live Query Server;
- Changed the cacheTimeout to default 5s;
- Changed the docs to reflect the actual 5s default for cacheTimeout.



Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: parse-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.4.0
Cross-Site Scripting in ternary conditional operator
Advisory: GHSA-7733-hjv6-4h47 (CVE-2020-15241)
Published: 2020-10-08T19:55:53Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0)
> * CWE-79

---

:information_source: &nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

---

### Problem
It has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

```
{showFullName ? fullName : defaultValue}
```

### Solution
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases:
* TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5)
* TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1)

### Credits
Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

### References
* [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.5
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.4
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.5
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.4.0
fixed: 2.4.1
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.5.0
fixed: 2.5.5
package: ecosystem: Packagist, name: typo3fluid/fluid, ranges: type: ECOSYSTEM, events: introduced: 2.6.0
fixed: 2.6.1
XSS vulnerability when listing users on add & modify server pages.
Advisory: GHSA-5822-pw57-vv37 ()
Published: 2020-10-08T20:13:19Z

### Impact
An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

### Patches
This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

### Workarounds
No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

### For more information
If you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot `io`.

_Thank you to Sergej for the responsible disclosure of this issue._

Affected packages:
package: ecosystem: Packagist, name: pterodactyl/panel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.19
package: ecosystem: Packagist, name: pterodactyl/panel, ranges: type: ECOSYSTEM, events: introduced: 1.0.0-rc.0
fixed: 1.0.0-rc.7, database_specific: last_known_affected_version_range: <= 1.0.0-rc.6
systeminformation command injection vulnerability
Advisory: GHSA-94xh-2fmc-xf5j (CVE-2020-7752)
Published: 2020-10-27T20:30:20Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: systeminformation, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.27.11
Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs
Advisory: GHSA-r82c-j4mq-5xfw ()
Published: 2020-10-27T19:19:56Z

### Impact
Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.5.0 can generate an invalid short URL when a vanity domain exists.

### Patches
Upgrading `bitlyshortener` to 0.5.0 or newer will prevent the generation of any such invalid short URLs.

### References
* [Release notes](https://github.com/impredicative/bitlyshortener/releases)

Affected packages:
package: ecosystem: PyPI, name: bitlyshortener, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.0