{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"Every tagged sbom-auditor release up to 1.6.34 (26 tags, v0.1.0 to v1.6.34) locks ctutils 0.4.2 or 0.4.3, which RUSTSEC-2026-0385 (2026-10-23) reports as generating masks and comparing u128 values in non-constant time: the generated code could include a branch on secret values on commonly used platforms, and u128 comparisons branched on 32-bit targets. Branches on secrets can leak them through covert channels. sbom-auditor 1.6.35 links ctutils 0.4.5; the fix is in 0.4.4.","title":"Summary"},{"category":"description","text":"ctutils reaches sbom-auditor through chacha20poly1305 -> poly1305 -> universal-hash, the AEAD (XChaCha20-Poly1305, src/crypto.rs) behind the optional storage encryption of stored SBOM bytes. Whether the timing difference is reachable through sbom-auditor's use of that AEAD has NOT been assessed: no exploitability analysis was made. The scores below are a conservative estimate of a network attacker measuring timing with high complexity and a low confidentiality impact; RustSec publishes no CVSS vector for this advisory.","title":"Description"},{"category":"details","text":"cargo update -p ctutils: ctutils 0.4.3 -> 0.4.5 (the newest release; the fix is in 0.4.4). Only this one entry in Cargo.lock changes. Verified on the sbom-auditor tree with the updated Cargo.lock (commit 3d1d2b20): cargo fmt --check, cargo clippy -D warnings, the test suite (744 unit tests, the integration tests and the doctests), cargo doc, cargo audit, cargo deny and cargo vet pass.","title":"Fix"},{"category":"general","text":"Upgrade to sbom-auditor 1.6.35 (released on 2026-10-26) or later. No configuration change is required. Releases up to 1.6.34 cannot be fixed in place: they carry the affected crate in the binary.","title":"Recommended action"},{"category":"other","text":"CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N = 3.7 (LOW). CVSS v4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 6.3 (MEDIUM). Both are ndaal's own conservative estimate, not taken from RustSec, and are scored for the worst case: the AEAD tag check. The cargo-vet exemption for ctutils moved to 0.4.5 without a review of the changed lines.","title":"Scoring and applicability"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"URL to this CSAF document (ndaal-sa-2026-1019)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1019/ndaal-sa-2026-1019.json"},{"category":"external","summary":"RUSTSEC-2026-0385 (ctutils)","url":"https://rustsec.org/advisories/RUSTSEC-2026-0385.html"},{"category":"external","summary":"RustCrypto/utils pull request 1569","url":"https://github.com/RustCrypto/utils/pull/1569"},{"category":"external","summary":"ctutils crate on crates.io","url":"https://crates.io/crates/ctutils"},{"category":"external","summary":"sbom-auditor releases","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases"},{"category":"external","summary":"sbom-auditor 1.6.35 on crates.io","url":"https://crates.io/crates/sbom-auditor/1.6.35"},{"category":"external","summary":"sbom-auditor 1.6.35 release on GitLab","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases/v1.6.35"}],"title":"ndaal Security Advisory: sbom-auditor 1.6.34 and earlier ship ctutils 0.4.2 or 0.4.3, whose constant-time mask generation and u128 comparisons can branch on secret values","tracking":{"current_release_date":"2026-10-26T02:19:12.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-1019","initial_release_date":"2026-10-26T02:19:12.000Z","revision_history":[{"date":"2026-10-26T02:19:12.000Z","number":"1.0.0","summary":"Initial release. Security advisory for RUSTSEC-2026-0385 in sbom-auditor 1.6.34 and earlier, fixed in sbom-auditor 1.6.35 (released on 2026-10-26)."}],"status":"final","version":"1.0.0"},"x_extensions":[{"$schema":"https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json","category":"informational","content":{"dashboard_short_name":"ndaal","publisher_brand":"ndaal Advisories Database"},"critical":false}]},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"vers:cargo/<=1.6.34","product":{"name":"ndaal sbom-auditor 1.6.34 and earlier (ctutils 0.4.2 or 0.4.3)","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.35","product":{"name":"ndaal sbom-auditor 1.6.35 (ctutils 0.4.5)","product_id":"CSAFPID-0002","product_identification_helper":{"purls":["pkg:cargo/sbom-auditor@1.6.35"]}}}],"category":"product_name","name":"sbom-auditor"}],"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"}]},"vulnerabilities":[{"ids":[{"system_name":"RUSTSEC","text":"RUSTSEC-2026-0385"}],"metrics":[{"content":{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cvss_v4":{"attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"notes":[{"category":"description","text":"In ctutils releases before 0.4.4, the const fn mask generation in ctutils::Choice could compile to a branch on commonly used platforms, and u128 comparisons generated branches on 32-bit targets. Branch instructions on secret values can leak them via covert channels.","title":"Vulnerability description"}],"product_status":{"fixed":["CSAFPID-0002"],"known_affected":["CSAFPID-0001"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to sbom-auditor 1.6.35, which links ctutils 0.4.5.","product_ids":["CSAFPID-0001"]}],"title":"ctutils: non-constant-time mask generation and u128 comparisons"}]}