Edit ndaal-sa-2026-044

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Two related findings + fixes shipped together.

FINDING 1 — openSUSE / SUSE CSAF feed: 77 / 85,559 (0.09%) of advisories from a single upstream publisher (openSUSE / SUSE) contain Latin-1 / CP1252 bytes inside JSON string fields, violating RFC 8259 §8.1 ("JSON text exchanged between systems that are not part of a closed ecosystem MUST be encoded using UTF-8") and CSAF 2.1 §9.1.5 ("A CSAF document MUST be encoded in UTF-8").  Bytes seen: 0xae=®, 0xe9=é, 0xa0=NBSP, 0xf6=ö, 0xb3=³, 0xb9=¹, 0xa7=§, 0xea=ê, 0xfc=ü, 0xb0=°, 0xe1=á, 0xb6=¶, 0xf8=ø, 0xb2=², 0xed=í.

FIX 1 (strict mode + clean skip) — `crates/vl-feeders/src/csaf_generic.rs` was changed to keep its existing strict `tokio::fs::read_to_string` decode (UTF-8 only) and skip non-compliant files cleanly with an explicit, RFC-cited warning so operators understand it is an upstream-publisher bug.  This is the *opposite* of a Latin-1 fallback / salvage path: nvulnlookup deliberately stays a strict CSAF 2.1 consumer.  Three motivations: (a) the bytes-on-disk stay a faithful mirror of the upstream feed (no encoding transformation in our import pipeline); (b) the operator sees an `InvalidData` warning that routes the bug to the publisher (`bugzilla.suse.com`) instead of masking it; (c) downstream consumers querying our database get only spec-compliant content.  Cost: 77 advisories per import cycle missing from the index until openSUSE fixes their emitter — accepted because at 0.09% of the csaf_opensuse corpus the data-loss is bounded and visible, and salvaging would set a precedent of papering over spec violations.

FINDING 2 — TuxCare CSAF feed: of 144 distributions advertised by `https://security.tuxcare.com/csaf/v2/provider-metadata.json`, 4 are hosted on the `repo.tuxcare.com` subdomain (centos7-els + oraclelinux7-els × {advisories, vex}) and return HTTP 404 on both `index.txt` and `changes.csv`.  The other 140 (all on `security.tuxcare.com`) work normally.  The downloader propagated the first 404 with `?` and aborted the entire feeder, losing the 140 working distributions too.

FIX 2 (per-distribution resilience) — `crates/vl-feeders/src/csaf_downloader.rs` no longer propagates `discover_advisories` errors with `?` from the per-distribution loop.  Failures now log a warning and increment `report.failed` so sibling distributions still run.  TuxCare's 140 working distributions now import successfully and the 4 broken ones surface as visible per-directory warnings the operator can route to TuxCare support.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel