Edit ndaal-sa-2026-077

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

vulnerability-lookup-rs/scripts/update_ansible_role.sh has been hardened to close a version-drift loop and to refuse silently-malformed input.  Two complementary defects, one operational follow-up:

* BUG A (operational drift, surfaced by operator deploy 2026-05-26):
    The role-files-refresh script propagated the workspace `VL_VERSION`
    (resolved from `Cargo.toml`) only into binary copies and per-binary
    sidecars, NEVER into the embedded `nvulnlookup_version:` /
    `SCRIPT_VERSION='...'` strings scattered across the Ansible tree
    (playbook role-invocation override, both role defaults, eight Jinja2
    fallback defaults inside install_from_package.yml, three macOS
    bootstrap scripts).  An operator bumping 0.1.44 → 0.1.48 saw the
    role's files/ tree ship the new 0.1.48 packages but the playbook
    still pin `nvulnlookup_version: 0.1.44`, the install task resolve
    `vl-cli_0.1.44-1_*.deb` (a no-longer-existing filename), the install
    silently no-op, the prior 0.1.48 binary keep running, and
    `verify_deployed_version.yml` correctly catch the running-vs-declared
    mismatch with the misleading 'Running 0.1.48 but 0.1.44 was
    deployed' assertion.

* BUG B (fragile Cargo.toml fetch, latent):
    Version detection was a positional `grep -m1 '^version[[:space:]]*='`
    that grabbed the first version line anywhere in the workspace
    Cargo.toml.  Any future `[workspace.metadata.foo]` table with its
    own `version = '...'` field would silently poison `VL_VERSION` and
    propagate the wrong value across every consuming artefact.

* KNOWN follow-up (filed):
    `sed_in_place()` does not preserve the source file's mode when
    overwriting via the temp-file dance, stripping +x off the three
    macos_*_install.sh scripts under `umask 077`.  Mitigated in the
    current release by chmod +x post-hoc; root cause will land in a
    follow-up patch.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel