Edit ndaal-sa-2026-075

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

ndaal_public_nvulnlookup 0.1.48 is a hardening + reorganization release with four user-visible items. (1) The CWE dashboard has moved from `/dashboards/cwe` to `/attacks/cwe` under a new Attacks navbar dropdown (immediately after CAPEC), grouping every attack/weakness-pattern catalog under a single menu (CAPEC, CWE, MITRE ATT&CK Enterprise / ICS / Mobile, MITRE EMB3D); all three legacy CWE page paths now serve HTTP 308 Permanent Redirect to their `/attacks/cwe*` equivalents, so existing links and bookmarks survive unchanged. The `/api/v1/cwe/*` API namespace is intentionally NOT moved (matches the prior CAPEC relocation precedent). (2) The cryptographic-hash sidecar contract for every release artefact is now five orthogonal families covering four cryptographic constructions across three independent designs: SHA-2 (Merkle–Damgård), SHA-3 (Keccak sponge), BLAKE3 (tree hash), and SHAKE256 (extendable-output function). Both `vulnerability-lookup-rs/release/create_release.sh` and `vulnerability-lookup-rs/scripts/update_ansible_role.sh` emit the full set; a new idempotent + recompute-and-compare-verifying `backfill_5sidecar_contract.{sh,bats}` tool retroactively brought every release artefact from v0.1.31 through v0.1.48 and the Ansible role files up to the contract (315 new `.blake3-512` + 315 new `.shake256-512` per-file sidecars + 34 new aggregate manifests landed in this release). (3) A new `test_ndaal_binsec` quality gate runs the ndaal-binsec fork (native validated SARIF 2.1.0 + Markdown output) across every shipped release binary, complementing the existing upstream-binsec gate. (4) Five pre-existing structural bugs cleared in the `verify_static_assets_{molecule,debian13}.sh` screenshot/Ansible verify pipelines so they finally run end-to-end against a fresh Vagrant box and the six Molecule (Podman) container distributions.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel