{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Every tagged sbom-auditor release up to 1.6.34 (26 tags, v0.1.0 to v1.6.34) locks ctutils 0.4.2 or 0.4.3, which RUSTSEC-2026-0385 (2026-10-23) reports as generating masks and comparing u128 values in non-constant time: the generated code could include a branch on secret values on commonly used platforms, and u128 comparisons branched on 32-bit targets. Branches on secrets can leak them through covert channels. sbom-auditor 1.6.35 links ctutils 0.4.5; the fix is in 0.4.4.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "ctutils reaches sbom-auditor through chacha20poly1305 -> poly1305 -> universal-hash, the AEAD (XChaCha20-Poly1305, src/crypto.rs) behind the optional storage encryption of stored SBOM bytes. Whether the timing difference is reachable through sbom-auditor's use of that AEAD has NOT been assessed: no exploitability analysis was made. The scores below are a conservative estimate of a network attacker measuring timing with high complexity and a low confidentiality impact; RustSec publishes no CVSS vector for this advisory.",
        "title": "Description"
      },
      {
        "category": "details",
        "text": "cargo update -p ctutils: ctutils 0.4.3 -> 0.4.5 (the newest release; the fix is in 0.4.4). Only this one entry in Cargo.lock changes. Verified on the sbom-auditor tree with the updated Cargo.lock (commit 3d1d2b20): cargo fmt --check, cargo clippy -D warnings, the test suite (744 unit tests, the integration tests and the doctests), cargo doc, cargo audit, cargo deny and cargo vet pass.",
        "title": "Fix"
      },
      {
        "category": "general",
        "text": "Upgrade to sbom-auditor 1.6.35 (released on 2026-10-26) or later. No configuration change is required. Releases up to 1.6.34 cannot be fixed in place: they carry the affected crate in the binary.",
        "title": "Recommended action"
      },
      {
        "category": "other",
        "text": "CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N = 3.7 (LOW). CVSS v4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N = 6.3 (MEDIUM). Both are ndaal's own conservative estimate, not taken from RustSec, and are scored for the worst case: the AEAD tag check. The cargo-vet exemption for ctutils moved to 0.4.5 without a review of the changed lines.",
        "title": "Scoring and applicability"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "URL to this CSAF document (ndaal-sa-2026-1019)",
        "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1019/ndaal-sa-2026-1019.json"
      },
      {
        "category": "external",
        "summary": "RUSTSEC-2026-0385 (ctutils)",
        "url": "https://rustsec.org/advisories/RUSTSEC-2026-0385.html"
      },
      {
        "category": "external",
        "summary": "RustCrypto/utils pull request 1569",
        "url": "https://github.com/RustCrypto/utils/pull/1569"
      },
      {
        "category": "external",
        "summary": "ctutils crate on crates.io",
        "url": "https://crates.io/crates/ctutils"
      },
      {
        "category": "external",
        "summary": "sbom-auditor releases",
        "url": "https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases"
      },
      {
        "category": "external",
        "summary": "sbom-auditor 1.6.35 on crates.io",
        "url": "https://crates.io/crates/sbom-auditor/1.6.35"
      },
      {
        "category": "external",
        "summary": "sbom-auditor 1.6.35 release on GitLab",
        "url": "https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases/v1.6.35"
      }
    ],
    "title": "ndaal Security Advisory: sbom-auditor 1.6.34 and earlier ship ctutils 0.4.2 or 0.4.3, whose constant-time mask generation and u128 comparisons can branch on secret values",
    "tracking": {
      "current_release_date": "2026-10-26T02:19:12.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1019",
      "initial_release_date": "2026-10-26T02:19:12.000Z",
      "revision_history": [
        {
          "date": "2026-10-26T02:19:12.000Z",
          "number": "1.0.0",
          "summary": "Initial release. Security advisory for RUSTSEC-2026-0385 in sbom-auditor 1.6.34 and earlier, fixed in sbom-auditor 1.6.35 (released on 2026-10-26)."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    },
    "x_extensions": [
      {
        "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json",
        "category": "informational",
        "content": {
          "dashboard_short_name": "ndaal",
          "publisher_brand": "ndaal Advisories Database"
        },
        "critical": false
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:cargo/<=1.6.34",
                "product": {
                  "name": "ndaal sbom-auditor 1.6.34 and earlier (ctutils 0.4.2 or 0.4.3)",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "1.6.35",
                "product": {
                  "name": "ndaal sbom-auditor 1.6.35 (ctutils 0.4.5)",
                  "product_id": "CSAFPID-0002",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/sbom-auditor@1.6.35"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sbom-auditor"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "ids": [
        {
          "system_name": "RUSTSEC",
          "text": "RUSTSEC-2026-0385"
        }
      ],
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            },
            "cvss_v4": {
              "attackComplexity": "HIGH",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "privilegesRequired": "NONE",
              "subAvailabilityImpact": "NONE",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "userInteraction": "NONE",
              "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
              "version": "4.0",
              "vulnAvailabilityImpact": "NONE",
              "vulnConfidentialityImpact": "LOW",
              "vulnIntegrityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In ctutils releases before 0.4.4, the const fn mask generation in ctutils::Choice could compile to a branch on commonly used platforms, and u128 comparisons generated branches on 32-bit targets. Branch instructions on secret values can leak them via covert channels.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to sbom-auditor 1.6.35, which links ctutils 0.4.5.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "ctutils: non-constant-time mask generation and u128 comparisons"
    }
  ]
}