Edit ndaal-sa-2026-043

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

This advisory records the strict-validation repair sweep applied to all 41 prior 2026 advisories (ndaal-sa-2026-001 through ndaal-sa-2026-041) plus the cross-reference advisory 042.  Before the sweep, 33 advisories failed `csaf-validator --test basic --csaf-version 2.1` against strict CSAF 2.1 schema rules.  After the sweep, every advisory in `csaf/2026/` (42 total) PASSES both the official csaf-validator 0.4.1 AND the OASIS-hosted `csaf.json` schema (validated via Python jsonschema Draft 2020-12).

Three concrete artefacts ship together:

1. NEW tool `csaf/repair_csaf_validation_errors.sh` — an
     idempotent reparation script implementing 18 distinct
     CSAF 2.1 schema-correction patterns (labelled A through R).
     Each pattern is a no-op when its trigger condition is
     absent, so a clean tree gets zero byte-changes on re-run.

2. NEW sister test `csaf/repair_csaf_validation_errors.bats`
     — 16 bats-core tests covering CLAUDE.md's canonical 7-test
     baseline (existence, SPDX, bash-n, traps, set-o flags,
     print_script_info), the parse_cli_options short-circuit
     guards (--help/-h/-H/--version/-V each timeout-bounded),
     a --dry-run no-op smoke-test, and an idempotency guard.

3. REPAIRED 41 advisories + 123 sidecars regenerated.
     Every JSON byte-change triggered a fresh SHA-256 / SHA-512
     / SHA3-512 sidecar set, all verified end-to-end.

Validation results before / after:

Before:  9 / 42 PASS strict csaf-validator (33 failed)
           9 / 42 PASS strict OASIS jsonschema  (33 failed)

After:  42 / 42 PASS strict csaf-validator (0 failed)
          42 / 42 PASS strict OASIS jsonschema  (0 failed)

Key discovery during the repair work: an earlier note in
CLAUDE.md claiming `purl` was a `csaf-validator 0.4.1` schema
bug was INCORRECT.  CSAF 2.1 actually renamed the singular
`product_identification_helper.purl` field to a plural
`purls: [string]` array.  This is a real spec change, not a
validator bug.  Pattern H now performs the migration.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel