{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_informational_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"grundschutz-oscal-viewer 1.6.68 bumps the `ctutils` dependency 0.4.5 -> 0.4.6. Routine update (trivial: a semver-compatible patch release, so no source change was expected and none was needed). The crate is a transitive dependency, not one named in Cargo.toml, and it is compiled into the release binaries through chacha20poly1305, poly1305 and universal-hash. It remediates NO published security advisory (no RUSTSEC / CVE is fixed by this bump); it is recorded for supply-chain traceability. Security impact: none - CVSS v3.1 base score 0.0 (None).","title":"Summary"},{"category":"description","text":"No source change: only the version in Cargo.lock moved, and `cargo update -p ctutils` changed no other package. ctutils 0.4.6 (2026-10-25) adds the primitives::borrowing_sub_mask_u32 and borrowing_sub_mask_u64 helpers for propagating word-sized borrow masks, and fixes nothing; this repository calls neither. The ctutils code that runs here is the Poly1305 path of the annotation encryption at rest (--encryption-key-file), which was already on the version that fixed RUSTSEC-2026-0385 (0.4.4 or later; 1.6.67 locks 0.4.5). Checks run on the bumped tree: `cargo fmt --check`, `cargo clippy --workspace --all-targets --all-features -- -D warnings`, `cargo audit`, `cargo deny check` and the full test suite (`cargo test --all-targets --all-features`, plus the doctests).","title":"Upgrade Notes"},{"category":"general","text":"Security / CVSS assessment: this dependency update introduces and remediates no known vulnerability. It has no confidentiality, integrity, or availability impact. CVSS v3.1 base score: 0.0 (None). CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score: 0.0 (None). CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N. (Per CSAF rule 6.1.27.3 an informational advisory carries no /vulnerabilities element, so these scores are stated here rather than in a machine-readable metrics block.)","title":"CVSS / Security Assessment"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1099/ndaal-sa-2026-1099.json"},{"category":"external","summary":"ctutils crate on crates.io","url":"https://crates.io/crates/ctutils"},{"category":"external","summary":"grundschutz-oscal-viewer 1.6.68 CHANGELOG","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/blob/main/CHANGELOG.md"},{"category":"external","summary":"ctutils upstream changelog","url":"https://github.com/RustCrypto/utils/blob/master/ctutils/CHANGELOG.md"}],"title":"ndaal Informational Advisory: ctutils 0.4.5 -> 0.4.6 bump (grundschutz-oscal-viewer 1.6.68)","tracking":{"current_release_date":"2026-10-26T04:00:09.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-1099","initial_release_date":"2026-10-26T04:00:09.000Z","revision_history":[{"date":"2026-10-26T04:00:09.000Z","number":"0.0.1","summary":"Draft prepared before the release of grundschutz-oscal-viewer 1.6.68. Finalise (status final, version 1.0.0) when it ships."}],"status":"draft","version":"0.0.1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"1.6.68","product":{"name":"grundschutz-oscal-viewer 1.6.68 - ships ctutils 0.4.6","product_id":"CSAFPID-0001","product_identification_helper":{"purls":["pkg:cargo/grundschutz-oscal-viewer@1.6.68"]}}}],"category":"product_name","name":"grundschutz-oscal-viewer"}],"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG"}]}}