diff --git a/crates/personnummer/RUSTSEC-0000-0000.md b/crates/personnummer/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..2b63159 --- /dev/null +++ b/crates/personnummer/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "personnummer" +date = "2020-09-04" +url = "https://github.com/personnummer/rust/pull/4" +aliases = ["GHSA-28r9-pq4c-wp3c"] +informational = "notice" + +[versions] +patched = [">= 3.0.1"] +``` +# personnummer Input validation error + +Swedish personal identity is in the form of YYMMDD-XXXX + +An issue arises from the regular expression allowing the first three digits in +the last four digits of the personnummer to be 000, which is invalid. + +To mitigate this without upgrading, a check on the last four digits can be made +to make sure it's not 000x. + +The affected version should not be relied on without the mitigation to check +that the swedish personal identity number is valid.