Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The CSAF data model in ndaal_public_csaf_crud (the `csaf-models` crate, consumed by `csaf-core` / `csaf-crud` / `ndaal-csaf-cli`) serialized the CVSS v4.0 metric object using CVSS v3.1 property names. The `CvssV4` struct's vulnerable-system impact fields were emitted as `confidentialityImpact` / `integrityImpact` / `availabilityImpact` (the CVSS v3 names) instead of the CVSS v4 names `vulnConfidentialityImpact` / `vulnIntegrityImpact` / `vulnAvailabilityImpact`. As a result, any advisory the application serialized or exported that carried a CVSS v4 score produced a `cvss_v4` object that violates the CSAF 2.1 JSON schema (the embedded CVSS 4.0 schema sets `unevaluatedProperties: false`), so strict CSAF consumers reject the document. The CVSS vector string and base score were correct; only the structured property names were wrong. Fixed in 0.3.4 by renaming the three serde fields to the correct CVSS 4.0 names and enabling an on-by-default OASIS conformance gate on export."
},
{
"category": "description",
"text": "Affected code (pre-fix), `crates/csaf-models/src/csaf_document.rs`, `struct CvssV4`:\n\n #[serde(rename = \"confidentialityImpact\", ...)]\n pub confidentiality_impact: Option<String>,\n #[serde(rename = \"integrityImpact\", ...)]\n pub integrity_impact: Option<String>,\n #[serde(rename = \"availabilityImpact\", ...)]\n pub availability_impact: Option<String>,\n\nThe field doc-comments already described these as the \"vulnerable component\" impacts (i.e. CVSS 4.0 VC / VI / VA), so the rename strings were simply incorrect — they reused the CVSS v3.1 spelling. The official CVSS 4.0 schema embedded in CSAF 2.1 defines these as `vulnConfidentialityImpact` / `vulnIntegrityImpact` / `vulnAvailabilityImpact` and forbids unknown properties.\n\nConsequences:\n 1. Serialization: every `cvss_v4` object the application wrote (CSAF export, API responses, database snapshots) used the v3 names → schema-invalid under CSAF 2.1.\n 2. Deserialization: a conformant input document using the correct `vulnConfidentialityImpact` etc. did NOT populate the model fields (unknown to the v3-named struct), silently dropping the vulnerable-system sub-scores on round-trip.\n\nThe built-in `csaf_core::validation` validator did not catch this — it checks the CVSS base score and severity, not the structured CVSS property names against the JSON schema. The defect surfaced while wiring the official OASIS `csaf-rs` validator into the export and import paths for 0.3.4."
},
{
"category": "details",
"text": "Fix (0.3.4), `crates/csaf-models/src/csaf_document.rs`:\n - `confidentiality_impact` serde rename `confidentialityImpact` -> `vulnConfidentialityImpact`\n - `integrity_impact` serde rename `integrityImpact` -> `vulnIntegrityImpact`\n - `availability_impact` serde rename `availabilityImpact` -> `vulnAvailabilityImpact`\nThe subsequent-system sub-scores (`subConfidentialityImpact` / `subIntegrityImpact` / `subAvailabilityImpact`) were already correct and are unchanged. CVSS v3.1's `cvss_v3` object legitimately keeps the unprefixed `confidentialityImpact` / `integrityImpact` / `availabilityImpact` names and is unaffected.\n\nDefence in depth (0.3.4): the OASIS `csaf-rs` validator is now enabled by default and run as a hard gate on BOTH import and export (`csaf_core::oasis`). Export refuses to write — and import refuses to store — any advisory that fails the official CSAF 2.1 suite, so a future regression that produced a non-conformant `cvss_v4` object would be caught before bytes reach disk or the store.\n\nVerification (0.3.4):\n cargo test -p csaf-core --test test_oasis_gating (export/import OASIS gate, incl. cvss_v4 round-trip)\n cargo test -p csaf-models --lib (model serialization)\n scripts/validate_csaf_documents.sh --root csaf/2026 (csaf-validator basic, CSAF 2.1)"
},
{
"category": "general",
"text": "Recommended action: upgrade to ndaal_public_csaf_crud 0.3.4 or later, then re-export any advisories that contain CVSS v4 scores so the on-disk `cvss_v4` objects use the conformant property names. No configuration change is required; the corrected serialization and the OASIS export gate are enforced unconditionally in the default build. Operators who cannot upgrade immediately and who publish advisories with CVSS v4 should post-process exported files to rename the three `cvss_v4` impact keys, or omit the CVSS v4 metric. The hand-curated advisories published in this repository under `csaf/` already use the correct names and are not affected; the defect concerns advisories produced at runtime by the application's serializer."
},
{
"category": "other",
"text": "CVSS applicability and severity: this is a data-conformance / interoperability defect in the application's output, not an exploitable compromise of the application or its host. There is no confidentiality or availability impact on the system itself; the integrity impact is limited to the produced advisory artefact (a malformed `cvss_v4` object) and the practical effect is that a strict CSAF consumer rejects an exported advisory that carries a CVSS v4 score. Scored CVSS v3.1 3.3 (LOW) and CVSS v4.0 2.3 (LOW) accordingly. Exploitation requires operating the tool to export an advisory; it is not remotely triggerable. Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/raw/main/csaf/2026/073/ndaal-sa-2026-073.json"
},
{
"category": "external",
"summary": "ndaal-sa-2026-072 — related CSAF 2.1 schema-conformance defect in test fixtures",
"url": "https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/raw/main/csaf/2026/072/ndaal-sa-2026-072.json"
},
{
"category": "external",
"summary": "CWE-1287 — Improper Validation of Specified Type of Input",
"url": "https://cwe.mitre.org/data/definitions/1287.html"
},
{
"category": "external",
"summary": "CVSS v4.0 specification — vulnerable / subsequent system metric names (VC/VI/VA, SC/SI/SA)",
"url": "https://www.first.org/cvss/v4-0/specification-document"
},
{
"category": "external",
"summary": "CSAF 2.1 specification (OASIS)",
"url": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html"
},
{
"category": "external",
"summary": "ndaal_public_csaf_crud repository",
"url": "https://gitlab.com/vPierre/ndaal_public_csaf_crud"
}
],
"title": "ndaal Security Advisory: CVSS v4 metric serialized with CVSS v3 property names in the CSAF data model — fixed in 0.3.4",
"tracking": {
"current_release_date": "2026-05-25T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-073",
"initial_release_date": "2026-05-25T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-25T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory documenting that the CSAF data model (csaf-models `CvssV4`) serialized CVSS v4.0 vulnerable-system impact fields with CVSS v3.1 property names (`confidentialityImpact`/`integrityImpact`/`availabilityImpact` instead of `vulnConfidentialityImpact`/`vulnIntegrityImpact`/`vulnAvailabilityImpact`), making every exported advisory with a CVSS v4 score non-conformant with the CSAF 2.1 schema. Fixed in 0.3.4 by correcting the three serde renames and enabling an on-by-default OASIS conformance gate on import and export. CVSS v3.1 3.3 / v4.0 2.3 (LOW). Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "csaf-models",
"branches": [
{
"category": "product_version_range",
"name": "vers:cargo/<0.3.4",
"product": {
"name": "ndaal_public_csaf_crud (csaf-models / csaf-core / csaf-crud / ndaal-csaf-cli) before 0.3.4 — the CvssV4 model serializes cvss_v4 vulnerable-system impacts with CVSS v3 property names, producing CSAF 2.1 schema-invalid cvss_v4 objects on export/serialization.",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.3.4",
"product": {
"name": "ndaal_public_csaf_crud 0.3.4 — CvssV4 serializes the correct CVSS 4.0 names (vulnConfidentialityImpact / vulnIntegrityImpact / vulnAvailabilityImpact); OASIS csaf-rs conformance gate enabled by default on import and export.",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "ndaal_public_csaf_crud before 0.3.4 serialized the CVSS v4 metric of exported CSAF advisories using CVSS v3 JSON property names instead of the CVSS 4.0 vulnerable-system names (vulnConfidentialityImpact / vulnIntegrityImpact / vulnAvailabilityImpact) and the subsequent-system Sub* names. The resulting cvss_v4 object is non-conformant with the OASIS CSAF 2.1 schema and may be rejected by strict consumers. This is a data-conformance defect in produced advisory artefacts; it has no confidentiality or availability impact on the application or host. Fixed in 0.3.4, which emits cvss_v4 with the correct property names and gates export/import on the OASIS CSAF 2.1 schema suite; re-export any advisory that carries a CVSS v4 score."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to ndaal_public_csaf_crud 0.3.4 (CSAFPID-0002), which serializes cvss_v4 with the correct CVSS 4.0 vulnerable-system impact names and gates export/import on the OASIS CSAF 2.1 suite. Re-export advisories that contain CVSS v4 scores.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 3.3,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low impact: a data-conformance defect in produced advisory artefacts. Exported advisories carrying a CVSS v4 score are CSAF-2.1 schema-invalid and may be rejected by strict consumers; no confidentiality or availability impact on the application or host, and no remote exploitability."
}
],
"title": "CVSS v4 metric serialized with CVSS v3 property names (cvss_v4 schema non-conformance)"
}
]
}