Edit ndaal-sa-2026-233

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

grundschutz-oscal-viewer 1.6.40 is a feature, test-coverage and code-quality release on top of the 1.6.39 line, published to crates.io and released on GitLab as v1.6.40 on 2026-07-08. It adds a CMMI-style Maturity Level picker to the annotation editor (/annotations) with the six levels 0 Incomplete, 1 Performed, 2 Managed, 3 Established, 4 Predictable and 5 Innovating (default 1 Performed); each saved annotation version stores its own maturity level in a new maturity column added by an idempotent migration. The opt-in --seed-demo seeder and its canonical test sequence were extended to fifteen append-only versions whose V10–V15 walk the maturity level. It further expands the automated test surface (full router-endpoint Bruno coverage, Maturity property tests, a fuzz_store_maturity cargo-fuzz target, Playwright maturity coverage) and refactors parse_args to clear a cyclomatic-complexity gate. The release also carries fifteen Low-severity hardening fixes tracked individually in ndaal-sa-2026-234 through ndaal-sa-2026-248. None of these introduce or fix a vulnerability in the shipped viewer; 1.6.40 is scored CVSS 0.0 (NONE).

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

This advisory announces the 1.6.40 changeset landed on main (commits 3d97dca6 the Maturity Level feature, f6b04e79 the Bruno/proptest/fuzz/Playwright coverage, 913e5e43 the parse_args complexity refactor); the versioned publish to crates.io and the GitLab release tag follow via the release pipeline. 1.6.40 collects no scored findings. The new Maturity Level form field is not an added attack surface: its submitted value is parsed through an enum allow-list (Maturity::from_token accepts only the digits 0-5) and falls back to the default 1 (Performed) on any other input rather than being trusted, and it is persisted exclusively as a bound SQLite parameter, so it is never interpreted as SQL and cannot widen an injection surface. The maturity write/read path was exercised by two proptest properties, a new fuzz_store_maturity libFuzzer target, a cargo-mutants pass over the maturity surface (100% kill of viable mutants) and a Miri run over the FFI-free maturity logic (0 undefined behaviour). The Bruno additions and the parse_args refactor are test-only / internal-behaviour-preserving changes. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel