| id: GO-TEST-ID |
| modules: |
| - module: github.com/personnummer/go |
| versions: |
| - fixed: 3.0.1 |
| summary: personnummer/go vulnerable to Improper Input Validation |
| description: |- |
| This vulnerability was reported to the personnummer team in June 2020. The slow |
| response was due to locked ownership of some of the affected packages, which |
| caused delays to update packages prior to disclosure. |
| |
| The vulnerability is determined to be low severity. |
| |
| ### Impact |
| |
| This vulnerability impacts users who rely on the for last digits of personnummer |
| to be a _real_ personnummer. |
| |
| ### Patches |
| |
| The issue have been patched in all repositories. The following versions should |
| be updated to as soon as possible: |
| |
| [C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2 D 3.0.1 |
| [Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3 Elixir 3.0.0 |
| [Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1 |
| [Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0 |
| [JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0 Kotlin |
| 1.1.0 Lua 3.0.1 [PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2 |
| Perl 3.0.0 [Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2 |
| [Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1 |
| [Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0 Scala 3.0.1 |
| Swift 1.0.1 |
| |
| If you are using any of the earlier packages, please update to latest. |
| |
| ### Workarounds |
| |
| The issue arrieses from the regular expression allowing the first three digits |
| in the last four digits of the personnummer to be 000, which is invalid. To |
| mitigate this without upgrading, a check on the last four digits can be made to |
| make sure it's not 000x. |
| |
| ### For more information |
| |
| If you have any questions or comments about this advisory: |
| * Open an issue in [Personnummer |
| Meta](https://github.com/personnummer/meta/issues) |
| * Email us at [Personnummer Email](mailto:security@personnummer.dev) |
| ghsas: |
| - GHSA-hv53-vf5m-8q94 |
| references: |
| - advisory: https://github.com/personnummer/go/security/advisories/GHSA-hv53-vf5m-8q94 |
| - web: https://pkg.go.dev/github.com/personnummer/go |
| notes: |
| - lint: 'modules[0] "github.com/personnummer/go": version 3.0.1 does not exist' |
| - lint: 'summary: must begin with a capital letter' |
| - lint: 'summary: must contain an affected module or package path (e.g. "github.com/personnummer/go")' |