csaf_ndaal:ndaal-sa-2026-1099

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "grundschutz-oscal-viewer 1.6.68 bumps the `ctutils` dependency 0.4.5 -> 0.4.6. Routine update (trivial: a semver-compatible patch release, so no source change was expected and none was needed). The crate is a transitive dependency, not one named in Cargo.toml, and it is compiled into the release binaries through chacha20poly1305, poly1305 and universal-hash. It remediates NO published security advisory (no RUSTSEC / CVE is fixed by this bump); it is recorded for supply-chain traceability. Security impact: none - CVSS v3.1 base score 0.0 (None).",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "No source change: only the version in Cargo.lock moved, and `cargo update -p ctutils` changed no other package. ctutils 0.4.6 (2026-10-25) adds the primitives::borrowing_sub_mask_u32 and borrowing_sub_mask_u64 helpers for propagating word-sized borrow masks, and fixes nothing; this repository calls neither. The ctutils code that runs here is the Poly1305 path of the annotation encryption at rest (--encryption-key-file), which was already on the version that fixed RUSTSEC-2026-0385 (0.4.4 or later; 1.6.67 locks 0.4.5). Checks run on the bumped tree: `cargo fmt --check`, `cargo clippy --workspace --all-targets --all-features -- -D warnings`, `cargo audit`, `cargo deny check` and the full test suite (`cargo test --all-targets --all-features`, plus the doctests).",
        "title": "Upgrade Notes"
      },
      {
        "category": "general",
        "text": "Security / CVSS assessment: this dependency update introduces and remediates no known vulnerability. It has no confidentiality, integrity, or availability impact. CVSS v3.1 base score: 0.0 (None). CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N. CVSS v4.0 base score: 0.0 (None). CVSS v4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N. (Per CSAF rule 6.1.27.3 an informational advisory carries no /vulnerabilities element, so these scores are stated here rather than in a machine-readable metrics block.)",
        "title": "CVSS / Security Assessment"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/1099/ndaal-sa-2026-1099.json"
      },
      {
        "category": "external",
        "summary": "ctutils crate on crates.io",
        "url": "https://crates.io/crates/ctutils"
      },
      {
        "category": "external",
        "summary": "grundschutz-oscal-viewer 1.6.68 CHANGELOG",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/blob/main/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "ctutils upstream changelog",
        "url": "https://github.com/RustCrypto/utils/blob/master/ctutils/CHANGELOG.md"
      }
    ],
    "title": "ndaal Informational Advisory: ctutils 0.4.5 -> 0.4.6 bump (grundschutz-oscal-viewer 1.6.68)",
    "tracking": {
      "current_release_date": "2026-10-26T04:00:09.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-1099",
      "initial_release_date": "2026-10-26T04:00:09.000Z",
      "revision_history": [
        {
          "date": "2026-10-26T04:00:09.000Z",
          "number": "0.0.1",
          "summary": "Draft prepared before the release of grundschutz-oscal-viewer 1.6.68. Finalise (status final, version 1.0.0) when it ships."
        }
      ],
      "status": "draft",
      "version": "0.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.6.68",
                "product": {
                  "name": "grundschutz-oscal-viewer 1.6.68 - ships ctutils 0.4.6",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purls": [
                      "pkg:cargo/grundschutz-oscal-viewer@1.6.68"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "grundschutz-oscal-viewer"
          }
        ],
        "category": "vendor",
        "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG"
      }
    ]
  }
}