csaf_ndaal:ndaal-sa-2026-1020

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "sbom-auditor 1.6.35 bumps the `erased-serde` dependency 0.4.10 -> 0.4.11. This is a routine patch update (trivial: semver-compatible, no source change). It remediates NO published security advisory (no RUSTSEC / CVE is fixed by this bump); it is recorded for supply-chain traceability. Security impact: none - CVSS v3.1 base score 0.0 (None).",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "No source change: only `Cargo.lock` changes (`cargo update`). Verified on the sbom-auditor tree with the updated Cargo.lock (commit 3d1d2b20): cargo fmt --check, cargo clippy -D warnings, the test suite (744 unit tests, the integration tests and the doctests), cargo doc, cargo audit, cargo deny and cargo vet pass.",
        "title": "Upgrade Notes"
      },
      {
        "category": "general",
        "text": "Security / CVSS assessment: this dependency update introduces and remediates no known vulnerability. It has no confidentiality, integrity, or availability impact. CVSS v3.1 base score: 0.0 (None). CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score: 0.0 (None). CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N. (Per CSAF rule 6.1.27.3 an informational advisory carries no /vulnerabilities element, so these scores are stated here rather than in a machine-readable metrics block.)",
        "title": "CVSS / Security Assessment"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1020/ndaal-sa-2026-1020.json"
      },
      {
        "category": "external",
        "summary": "erased-serde crate on crates.io",
        "url": "https://crates.io/crates/erased-serde"
      },
      {
        "category": "external",
        "summary": "sbom-auditor 1.6.35 CHANGELOG",
        "url": "https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/raw/v1.6.35/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "sbom-auditor 1.6.35 on crates.io",
        "url": "https://crates.io/crates/sbom-auditor/1.6.35"
      },
      {
        "category": "external",
        "summary": "sbom-auditor 1.6.35 release on GitLab",
        "url": "https://gitlab.com/vPierre/ndaal_public_sbom_auditor/-/releases/v1.6.35"
      }
    ],
    "title": "ndaal Informational Advisory: erased-serde 0.4.10 -> 0.4.11 bump (sbom-auditor 1.6.35)",
    "tracking": {
      "current_release_date": "2026-10-26T02:19:12.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1020",
      "initial_release_date": "2026-10-26T02:19:12.000Z",
      "revision_history": [
        {
          "date": "2026-10-26T02:19:12.000Z",
          "number": "1.0.0",
          "summary": "Initial release. Informational advisory documenting the erased-serde 0.4.10 -> 0.4.11 bump shipped in sbom-auditor 1.6.35 (released on 2026-10-26)."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.6.35",
                "product": {
                  "name": "sbom-auditor 1.6.35 - ships erased-serde 0.4.11",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/sbom-auditor@1.6.35"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "sbom-auditor"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  }
}