Improper Input Validation in personnummer/python
Summary
GHSA-rxq3-5249-8hgg: personnummer/python vulnerable to Improper Input Validation. Affects personnummer versions < 3.0.2. Fixed in 3.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
personnummer/python is an open-source package available on PyPI. It is designed to validate and generate Swedish personal identity numbers (personnummer). These numbers are used for identification purposes in Sweden. The package provides functionality to validate the format and check the validity of personnummer. However, it is vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in personnummer/python allows the first three digits in the last four digits of the personnummer to be 000, which is invalid. This can lead to incorrect validation of personnummer, potentially impacting users who rely on the last digits of personnummer to be a real personnummer. The issue arises from a regular expression allowing the invalid digits. The impact of this vulnerability is considered low severity.
How To Fix
Minimum fixed version
3.0.2
This is the first release that contains the fix.
pip install --upgrade "personnummer==3.0.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, a workaround can be implemented by checking the last four digits of the personnummer to ensure they are not 000x. Here is an example code snippet in Python:
def validate_personnummer(personnummer):
last_four_digits = personnummer[-4:]
if last_four_digits == '000x':
return False
# continue with validation
return True
Conclusion
The vulnerability in personnummer/python allows for improper input validation of personnummer. It is recommended to update to the latest version of the package (3.0.2 or later) to fix the vulnerability. If upgrading is not possible, implementing the provided workaround can mitigate the issue. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for personnummer →
FAQ
personnummer/python is an open-source package that provides functionality to validate and generate Swedish personal identity numbers (personnummer).
A personnummer is a unique personal identification number used in Sweden. It consists of a 10-digit number with a specific format.
The vulnerability in personnummer/python can lead to incorrect validation of personnummer, potentially impacting users who rely on the last digits of personnummer to be a real personnummer. However, the severity of the impact is considered low.
To fix the vulnerability, you should update your personnummer/python package to version 3.0.2 or later. This can be done by running the command 'pip install --upgrade personnummer'.
Yes, if upgrading to the latest version is not possible, you can implement a workaround by checking the last four digits of the personnummer to ensure they are not 000x. Refer to the 'workaround' section for example code.
References
Related vulnerabilities
Recent vulnerabilities recorded for personnummer.
