Edit ndaal-sa-2026-079

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

mimetype-cli 0.1.3 (Rust binary + library crate published from ndaal_public_mediatypes-cli) lifts the capability-secure filesystem layer onto the upstream-supported cap-std / cap-tempfile v4 line.  The 3.x line — which 0.1.2 had just introduced (see ndaal-sa-2026-078) — is now off the Bytecode Alliance's supported-major cadence; this release moves to v4 to stay inside the security-backport window for `openat2(RESOLVE_BENEATH)` correctness fixes and future capability-handle hardening.  The v3 → v4 jump is API-quiet at the surface mimetype-cli uses (`Dir::open`, `Dir::open_ambient_dir`, `Dir::create`, `Dir::open_dir`, `Dir::entries`, `Dir::rename`, `Dir::read_to_string`, `TempDir::new` — all unchanged).  No source-file edits were needed to compile or pass the existing 60-vector path-traversal regression suite from 0.1.2.

Dependency-graph diff vs 0.1.2 (cargo update lockfile):
  cap-std       3   → 4   (3.4.5 → 4.0.2 on the lockfile)
  cap-tempfile  3   → 4   (3.4.5 → 4.0.2 on the lockfile)
  io-extras     0.18.4 → 0.19.0   (new minor)
  io-lifetimes  -- → 3.0.1   (new transitive)
  rand          0.8.6 → -- (no longer pulled in by the v4 line)
  rand_chacha   0.3.1 → -- (same)
  rand_core     0.6.4 → -- (same)
  getrandom     0.2.17 → -- (same)
  wasi          0.11.1 → -- (same)

Net supply-chain effect: 5 transitive crates DROP off the graph (rand + 4 of its transitives), 1 crate is added (io-lifetimes), 1 crate is bumped (io-extras).  The drop of rand/getrandom/wasi is a defence-in-depth win — fewer transitive crates means a smaller cargo-audit / cargo-vet surface.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel