{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"The CSAF data model in ndaal_public_csaf_crud (the `csaf-models` crate, consumed by `csaf-core` / `csaf-crud` / `ndaal-csaf-cli`) serialized the CVSS v4.0 metric object using CVSS v3.1 property names. The `CvssV4` struct's vulnerable-system impact fields were emitted as `confidentialityImpact` / `integrityImpact` / `availabilityImpact` (the CVSS v3 names) instead of the CVSS v4 names `vulnConfidentialityImpact` / `vulnIntegrityImpact` / `vulnAvailabilityImpact`. As a result, any advisory the application serialized or exported that carried a CVSS v4 score produced a `cvss_v4` object that violates the CSAF 2.1 JSON schema (the embedded CVSS 4.0 schema sets `unevaluatedProperties: false`), so strict CSAF consumers reject the document. The CVSS vector string and base score were correct; only the structured property names were wrong. Fixed in 0.3.4 by renaming the three serde fields to the correct CVSS 4.0 names and enabling an on-by-default OASIS conformance gate on export."},{"category":"description","text":"Affected code (pre-fix), `crates/csaf-models/src/csaf_document.rs`, `struct CvssV4`:\n\n    #[serde(rename = \"confidentialityImpact\", ...)]\n    pub confidentiality_impact: Option<String>,\n    #[serde(rename = \"integrityImpact\", ...)]\n    pub integrity_impact: Option<String>,\n    #[serde(rename = \"availabilityImpact\", ...)]\n    pub availability_impact: Option<String>,\n\nThe field doc-comments already described these as the \"vulnerable component\" impacts (i.e. CVSS 4.0 VC / VI / VA), so the rename strings were simply incorrect — they reused the CVSS v3.1 spelling. The official CVSS 4.0 schema embedded in CSAF 2.1 defines these as `vulnConfidentialityImpact` / `vulnIntegrityImpact` / `vulnAvailabilityImpact` and forbids unknown properties.\n\nConsequences:\n  1. Serialization: every `cvss_v4` object the application wrote (CSAF export, API responses, database snapshots) used the v3 names → schema-invalid under CSAF 2.1.\n  2. Deserialization: a conformant input document using the correct `vulnConfidentialityImpact` etc. did NOT populate the model fields (unknown to the v3-named struct), silently dropping the vulnerable-system sub-scores on round-trip.\n\nThe built-in `csaf_core::validation` validator did not catch this — it checks the CVSS base score and severity, not the structured CVSS property names against the JSON schema. The defect surfaced while wiring the official OASIS `csaf-rs` validator into the export and import paths for 0.3.4."},{"category":"details","text":"Fix (0.3.4), `crates/csaf-models/src/csaf_document.rs`:\n  - `confidentiality_impact` serde rename `confidentialityImpact` -> `vulnConfidentialityImpact`\n  - `integrity_impact`       serde rename `integrityImpact`       -> `vulnIntegrityImpact`\n  - `availability_impact`    serde rename `availabilityImpact`    -> `vulnAvailabilityImpact`\nThe subsequent-system sub-scores (`subConfidentialityImpact` / `subIntegrityImpact` / `subAvailabilityImpact`) were already correct and are unchanged. CVSS v3.1's `cvss_v3` object legitimately keeps the unprefixed `confidentialityImpact` / `integrityImpact` / `availabilityImpact` names and is unaffected.\n\nDefence in depth (0.3.4): the OASIS `csaf-rs` validator is now enabled by default and run as a hard gate on BOTH import and export (`csaf_core::oasis`). Export refuses to write — and import refuses to store — any advisory that fails the official CSAF 2.1 suite, so a future regression that produced a non-conformant `cvss_v4` object would be caught before bytes reach disk or the store.\n\nVerification (0.3.4):\n  cargo test -p csaf-core --test test_oasis_gating   (export/import OASIS gate, incl. cvss_v4 round-trip)\n  cargo test -p csaf-models --lib                     (model serialization)\n  scripts/validate_csaf_documents.sh --root csaf/2026  (csaf-validator basic, CSAF 2.1)"},{"category":"general","text":"Recommended action: upgrade to ndaal_public_csaf_crud 0.3.4 or later, then re-export any advisories that contain CVSS v4 scores so the on-disk `cvss_v4` objects use the conformant property names. No configuration change is required; the corrected serialization and the OASIS export gate are enforced unconditionally in the default build. Operators who cannot upgrade immediately and who publish advisories with CVSS v4 should post-process exported files to rename the three `cvss_v4` impact keys, or omit the CVSS v4 metric. The hand-curated advisories published in this repository under `csaf/` already use the correct names and are not affected; the defect concerns advisories produced at runtime by the application's serializer."},{"category":"other","text":"CVSS applicability and severity: this is a data-conformance / interoperability defect in the application's output, not an exploitable compromise of the application or its host. There is no confidentiality or availability impact on the system itself; the integrity impact is limited to the produced advisory artefact (a malformed `cvss_v4` object) and the practical effect is that a strict CSAF consumer rejects an exported advisory that carries a CVSS v4 score. Scored CVSS v3.1 3.3 (LOW) and CVSS v4.0 2.3 (LOW) accordingly. Exploitation requires operating the tool to export an advisory; it is not remotely triggerable. Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/raw/main/csaf/2026/073/ndaal-sa-2026-073.json"},{"category":"external","summary":"ndaal-sa-2026-072 — related CSAF 2.1 schema-conformance defect in test fixtures","url":"https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/raw/main/csaf/2026/072/ndaal-sa-2026-072.json"},{"category":"external","summary":"CWE-1287 — Improper Validation of Specified Type of Input","url":"https://cwe.mitre.org/data/definitions/1287.html"},{"category":"external","summary":"CVSS v4.0 specification — vulnerable / subsequent system metric names (VC/VI/VA, SC/SI/SA)","url":"https://www.first.org/cvss/v4-0/specification-document"},{"category":"external","summary":"CSAF 2.1 specification (OASIS)","url":"https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html"},{"category":"external","summary":"ndaal_public_csaf_crud repository","url":"https://gitlab.com/vPierre/ndaal_public_csaf_crud"}],"title":"ndaal Security Advisory: CVSS v4 metric serialized with CVSS v3 property names in the CSAF data model — fixed in 0.3.4","tracking":{"current_release_date":"2026-05-25T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-073","initial_release_date":"2026-05-25T00:00:00.000Z","revision_history":[{"date":"2026-05-25T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory documenting that the CSAF data model (csaf-models `CvssV4`) serialized CVSS v4.0 vulnerable-system impact fields with CVSS v3.1 property names (`confidentialityImpact`/`integrityImpact`/`availabilityImpact` instead of `vulnConfidentialityImpact`/`vulnIntegrityImpact`/`vulnAvailabilityImpact`), making every exported advisory with a CVSS v4 score non-conformant with the CSAF 2.1 schema. Fixed in 0.3.4 by correcting the three serde renames and enabling an on-by-default OASIS conformance gate on import and export. CVSS v3.1 3.3 / v4.0 2.3 (LOW). Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"csaf-models","branches":[{"category":"product_version_range","name":"vers:cargo/<0.3.4","product":{"name":"ndaal_public_csaf_crud (csaf-models / csaf-core / csaf-crud / ndaal-csaf-cli) before 0.3.4 — the CvssV4 model serializes cvss_v4 vulnerable-system impacts with CVSS v3 property names, producing CSAF 2.1 schema-invalid cvss_v4 objects on export/serialization.","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"0.3.4","product":{"name":"ndaal_public_csaf_crud 0.3.4 — CvssV4 serializes the correct CVSS 4.0 names (vulnConfidentialityImpact / vulnIntegrityImpact / vulnAvailabilityImpact); OASIS csaf-rs conformance gate enabled by default on import and export.","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"ndaal_public_csaf_crud before 0.3.4 serialized the CVSS v4 metric of exported CSAF advisories using CVSS v3 JSON property names instead of the CVSS 4.0 vulnerable-system names (vulnConfidentialityImpact / vulnIntegrityImpact / vulnAvailabilityImpact) and the subsequent-system Sub* names. The resulting cvss_v4 object is non-conformant with the OASIS CSAF 2.1 schema and may be rejected by strict consumers. This is a data-conformance defect in produced advisory artefacts; it has no confidentiality or availability impact on the application or host. Fixed in 0.3.4, which emits cvss_v4 with the correct property names and gates export/import on the OASIS CSAF 2.1 schema suite; re-export any advisory that carries a CVSS v4 score."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to ndaal_public_csaf_crud 0.3.4 (CSAFPID-0002), which serializes cvss_v4 with the correct CVSS 4.0 vulnerable-system impact names and gates export/import on the OASIS CSAF 2.1 suite. Re-export advisories that contain CVSS v4 scores.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Low impact: a data-conformance defect in produced advisory artefacts. Exported advisories carrying a CVSS v4 score are CSAF-2.1 schema-invalid and may be rejected by strict consumers; no confidentiality or availability impact on the application or host, and no remote exploitability."}],"title":"CVSS v4 metric serialized with CVSS v3 property names (cvss_v4 schema non-conformance)"}]}