{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_base","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"Release announcement for sbom-auditor 1.6.35, tagged v1.6.35 in the ndaal_public_sbom_auditor repository on GitLab on 2026-10-26 (commit 12038860) with prebuilt binaries for six targets, the cumulative release/SHA256SUMS and a five-family checksum sidecar for each file. The crate was published to crates.io at 1.6.35 on 2026-10-26. 1.6.35 adds the description, author, Open Graph and Twitter meta tags with a preview picture to every page, moves ctutils to 0.4.5 (RUSTSEC-2026-0385), refreshes 32 locked crates, corrects 79 quality-gate runners that audited a directory outside this repository, and fixes stale lines in the release checksum file. The public library API is unchanged from 1.6.34. This document is an announcement and reports no vulnerability of its own, so it is scored CVSS v3.1 and v4.0 0.0 (NONE). That score describes the announcement, not the release.","title":"Summary"},{"category":"description","text":"sbom-auditor is a Software Bill of Materials auditor written in Rust. It stores SBOMs, runs several analyzers over them, enriches the findings (SSVC, EPSS) and exports reports, including a CSAF 2.1 advisory generated from the findings. It runs as a web application and as a command-line tool.","title":"Product Description"},{"category":"details","text":"Reused from CHANGELOG.md [1.6.35]. ADDED — (1) Every page carries 14 meta tags (description, author, seven Open Graph and five Twitter tags) written once by the layout, in fixed English with absolute https://sbom.ndaal.eu/ URLs, after the charset and before the title; /social-preview.png serves a 1200 x 630 preview picture from the binary with a one-day cache lifetime, so a link preview shows a title, a text and an image. The picture needs a design review. htmx fragments carry no head. Tests: unit and router tests, three Bruno requests and a Playwright spec. (2) tests/scripts/test_csaf_draft_upload_via_api.sh tests Create CSAF document end to end: it uploads an SBOM, runs the analyzers, fetches the draft, triggers the upload and reads the stored draft back, passing only when the CSAF endpoint returns it with status draft; its 32 bats tests run against a fake curl. CHANGED — the page description is no longer translated; it is the fixed English sentence of the new tags, and the public K_META_DESCRIPTION constant stays, so the library API equals 1.6.34. FIXED — (1) 79 gate runners defaulted QG_WORKSPACE to a vulnerability-lookup-rs sub-directory that is not part of this repository, so a green gate said nothing about it; the default is now the repository root and a new bats test fails on any runner that defaults elsewhere. (2) Stage 3 of release/release_pipeline.sh compared names with the leading space of the two-space digest form and never dropped a version's old lines, so a rebuild left two digests under one asset name, which could fail the checksum check of --self-update; four new tests cover it. (3) The Administrator and Troubleshooting Guides no longer name a cause for csaf.ndaal.eu's 403 that the evidence does not support. SECURITY — ctutils 0.4.3 to 0.4.5 for RUSTSEC-2026-0385 (constant-time helper crate that built masks and compared u128 values in non-constant time; it reaches the build through chacha20poly1305, poly1305 and universal-hash, the AEAD behind the storage encryption); and a lockfile refresh of 32 crates (tokio 1.54.1, ureq 3.5.0 without socks, cc 1.10.0, uuid 1.29.0, self_update 1.3.2, the ICU4X crates 2.4 and others), none of which fixes a published advisory. The cargo-vet exemptions move to the new versions; these are recorded exemptions, not certifications. rusqlite 0.41, tantivy 0.27 and jsonschema 0.60 are breaking releases that stay as they are. RELEASE ARTEFACTS — on the GitLab release v1.6.35: sbom-auditor binaries for six targets, release/SHA256SUMS at the tag, and five per-file checksum sidecars (.sha-256, .sha-512, .sha3-512, .blake3-512, .shake256-512) for each file. KNOWN ISSUES — whether the ctutils timing difference is reachable in sbom-auditor's use has not been assessed.","title":"Release Contents"},{"category":"general","text":"Verification performed for the v1.6.35 release (tag commit 12038860, 2026-10-26). (1) The GitLab release v1.6.35 was checked from outside the build host: it lists the six binaries and the cumulative release/SHA256SUMS. (2) crates.io returns sbom-auditor 1.6.35, created 2026-10-26T00:33:45Z, with checksum 0c45ec5001a903a68fd7cc90e734a25b0bd07eaee1893381f42f36531e218547. (3) The production instance sbom.ndaal.eu runs 1.6.35: /healthz answers 200, /changelog shows [1.6.35] - 2026-10-25, the page head carries the 14 new tags (7 Open Graph and 5 Twitter among 16 meta tags) and /social-preview.png answers 200 with content-type image/png and 83316 bytes. (4) The commits that carry the changes passed the repository's pre-commit hook (rustfmt, clippy with warnings denied, tests and doctests, documentation build, typos, rust-doctor) and the pre-push hook (cargo audit, cargo deny, cargo semver-checks against 1.6.34, MSRV build). NOT verified and therefore not claimed: the binaries were not rebuilt a second time to compare them byte for byte; no detached signature exists for the release or the tag; the full quality-gate suite and the fuzz, mutation and load gates were not rerun for this release; the downloaded binaries were not run on every target; whether the ctutils timing difference is exploitable here was not assessed.","title":"Verification"},{"category":"general","text":"Upgrade to 1.6.35. Download the binary for your target from the release page, or run cargo install sbom-auditor --version 1.6.35, and compare the checksum in at least two of the five hash families; a checksum shows that a file matches the manifest published beside it, not that either is authentic, because detached signing is not in place. --self-update and cargo binstall resolve the binary through the GitLab release of vPierre/ndaal_public_sbom_auditor, which is where v1.6.35 is hosted. Deployments that rely on the page description being translated will see the fixed English sentence instead. Operators of the CSAF upload should know that the cause of csaf.ndaal.eu's occasional 403 is not determined; the Administrator Guide asks for POST and PUT on /api/v1/csaf to be exempted from the front-end rule.","title":"Recommended Action"},{"category":"other","text":"CVSS applicability: this is a release announcement and reports no vulnerability of its own, so the entry below carries the zero pair — v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N and v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N, both 0.0 (NONE). The zero score describes this document only. The finding the release clears has its own document: RUSTSEC-2026-0385 (ctutils) is ndaal-sa-2026-1019, a security advisory. The other 32-crate refresh bumps each have an informational advisory, ndaal-sa-2026-1016 to ndaal-sa-2026-1034 except 1019, scored CVSS 0.0 because none fixes a published advisory. The product is marked known_not_affected with the flag vulnerable_code_not_present only because the entry represents the announcement, not a vulnerability.","title":"CVSS / Security Assessment"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1098/ndaal-sa-2026-1098.json"},{"category":"external","summary":"sbom-auditor source code","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor"},{"category":"external","summary":"sbom-auditor v1.6.35 release on GitLab","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases/v1.6.35"},{"category":"external","summary":"sbom-auditor v1.6.35 tag on GitLab","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/tags/v1.6.35"},{"category":"external","summary":"sbom-auditor CHANGELOG at the v1.6.35 tag","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/blob/v1.6.35/CHANGELOG.md"},{"category":"external","summary":"sbom-auditor release checksums at the v1.6.35 tag (release/SHA256SUMS)","url":"https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/blob/v1.6.35/release/SHA256SUMS"},{"category":"external","summary":"sbom-auditor 1.6.35 on crates.io","url":"https://crates.io/crates/sbom-auditor/1.6.35"},{"category":"external","summary":"RUSTSEC-2026-0385 (ctutils)","url":"https://rustsec.org/advisories/RUSTSEC-2026-0385.html"},{"category":"external","summary":"ndaal-sa-2026-1016: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1016/ndaal-sa-2026-1016.json"},{"category":"external","summary":"ndaal-sa-2026-1017: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1017/ndaal-sa-2026-1017.json"},{"category":"external","summary":"ndaal-sa-2026-1018: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1018/ndaal-sa-2026-1018.json"},{"category":"external","summary":"ndaal-sa-2026-1019: lockfile bump advisory (ctutils, security advisory)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1019/ndaal-sa-2026-1019.json"},{"category":"external","summary":"ndaal-sa-2026-1020: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1020/ndaal-sa-2026-1020.json"},{"category":"external","summary":"ndaal-sa-2026-1021: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1021/ndaal-sa-2026-1021.json"},{"category":"external","summary":"ndaal-sa-2026-1022: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1022/ndaal-sa-2026-1022.json"},{"category":"external","summary":"ndaal-sa-2026-1023: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1023/ndaal-sa-2026-1023.json"},{"category":"external","summary":"ndaal-sa-2026-1024: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1024/ndaal-sa-2026-1024.json"},{"category":"external","summary":"ndaal-sa-2026-1025: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1025/ndaal-sa-2026-1025.json"},{"category":"external","summary":"ndaal-sa-2026-1026: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1026/ndaal-sa-2026-1026.json"},{"category":"external","summary":"ndaal-sa-2026-1027: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1027/ndaal-sa-2026-1027.json"},{"category":"external","summary":"ndaal-sa-2026-1028: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1028/ndaal-sa-2026-1028.json"},{"category":"external","summary":"ndaal-sa-2026-1029: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1029/ndaal-sa-2026-1029.json"},{"category":"external","summary":"ndaal-sa-2026-1030: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1030/ndaal-sa-2026-1030.json"},{"category":"external","summary":"ndaal-sa-2026-1031: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1031/ndaal-sa-2026-1031.json"},{"category":"external","summary":"ndaal-sa-2026-1032: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1032/ndaal-sa-2026-1032.json"},{"category":"external","summary":"ndaal-sa-2026-1033: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1033/ndaal-sa-2026-1033.json"},{"category":"external","summary":"ndaal-sa-2026-1034: lockfile bump advisory (informational)","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1034/ndaal-sa-2026-1034.json"}],"title":"ndaal Release Announcement: sbom-auditor 1.6.35 — page meta tags and preview image, ctutils 0.4.5 (RUSTSEC-2026-0385), 32 crates refreshed, 79 gate runners fixed (announcement scored CVSS 0.0)","tracking":{"current_release_date":"2026-10-26T02:33:35.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-1098","initial_release_date":"2026-10-26T02:33:35.000Z","revision_history":[{"date":"2026-10-26T02:33:35.000Z","number":"1.0.0","summary":"Release announcement for sbom-auditor 1.6.35; the announcement is scored CVSS 0.0, the release clears RUSTSEC-2026-0385, and the Verification note lists what was and was not verified"}],"status":"final","version":"1.0.0"},"x_extensions":[{"$schema":"https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json","category":"informational","content":{"dashboard_short_name":"ndaal","publisher_brand":"ndaal Advisories Database"},"critical":false}]},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"1.6.35","product":{"name":"ndaal sbom-auditor 1.6.35","product_id":"CSAFPID-0001","product_identification_helper":{"purls":["pkg:cargo/sbom-auditor@1.6.35"]}}}],"category":"product_name","name":"sbom-auditor"}],"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"}]},"vulnerabilities":[{"flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}],"ids":[{"system_name":"ndaal Advisory ID","text":"ndaal-sa-2026-1098"}],"metrics":[{"content":{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"cvss_v4":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":0.0,"baseSeverity":"NONE","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"notes":[{"category":"description","text":"Release announcement only. This entry represents the announcement itself and reports no vulnerability of its own. What the release changes is listed in the Release Contents note; the dependency findings it clears are assessed in the CVSS / Security Assessment note."},{"category":"details","text":"Highlights (full list in the Release Contents note): 14 meta tags and a preview picture on every page; ctutils 0.4.5 for RUSTSEC-2026-0385; a refresh of 32 locked crates; 79 gate runners that audited the wrong directory now audit this repository; stale lines in the release checksum file fixed. Open: no detached signature exists, and whether the ctutils timing difference is reachable has not been assessed."}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"threats":[{"category":"impact","details":"None for this entry: it is an informational release announcement and reports no vulnerability (CVSS v3.1 0.0 / v4.0 0.0, NONE). See Release Contents for what the release changes and CVSS / Security Assessment for the finding it clears.","product_ids":["CSAFPID-0001"]}],"title":"sbom-auditor 1.6.35 release — announcement entry (CVSS 0.0)"}]}