grundschutz-oscal-viewer 1.6.46 — release announcement: anti-DNS-rebinding request-Host allowlist plus a test/assurance hardening pass (testable annotation write-path seams, live schemathesis + cargo-tarpaulin gates, server DoS-mitigation resilience harness); advisories 287–291

Metadata

Vulnerabilities (0)

No vulnerabilities.

Raw JSON

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "grundschutz-oscal-viewer (the BSI Grundschutz++ OSCAL Viewer) 1.6.46 is a security- and assurance-focused release produced from the 2026-07-14 test-gap analysis. It ships one real behavioural remediation — an anti-DNS-rebinding request-Host allowlist (`--allowed-host` / `GSV_ALLOWED_HOSTS`) — together with a set of test and CI-assurance improvements: testable annotation write-path seams with 16 new branch tests, the previously-inert schemathesis contract gate and the previously-non-blocking cargo-tarpaulin coverage gate both made real and blocking, and a new server-stack DoS-mitigation resilience harness around `serve()` + `ServerLimits`. This announcement is informational and carries no scored finding of its own; the individual changes ship as CSAF advisories ndaal-sa-2026-287 through -291 (288 is the DNS-rebinding remediation, CVSS v3.1 LOW; 287, 289, 290 and 291 are informational / assurance, CVSS 0.0). Versions 1.6.44 and 1.6.45 were interim build cuts folded into this 1.6.46 announcement."
      },
      {
        "category": "description",
        "text": "Per the 1.6.46 release (from the 2026-07-14 test-gap analysis): (1) Anti-DNS-rebinding hardening — the server now enforces a request Host / `:authority` allowlist on same-origin write endpoints, configurable via `--allowed-host` (CLI) and `GSV_ALLOWED_HOSTS` (environment). This is the release's one behavioural security remediation, documented in ndaal-sa-2026-288 (CVSS v3.1 LOW). (2) Assurance and test-coverage work, each shipped as its own CVSS 0.0 advisory: the annotation write-path was refactored into testable sync seams and covered by 16 new branch tests (ndaal-sa-2026-287); the schemathesis contract gate — previously inert (self-skipped on the wrong port) — was made a real, blocking 38-route OpenAPI gate (ndaal-sa-2026-289); the cargo-tarpaulin coverage gate — previously non-blocking — now fails under 80% coverage (ndaal-sa-2026-290); and a server-stack DoS-mitigation resilience harness was added around `serve()` + `ServerLimits`, exercising the connection cap and anti-slowloris timeouts (ndaal-sa-2026-291). Beyond the request-Host allowlist, no viewer runtime behaviour changed."
      },
      {
        "category": "details",
        "text": "This is an informational release announcement (csaf_informational_advisory) and therefore carries no `/vulnerabilities` element; the remediation and the assurance items ship as their own CSAF advisories (287–291), referenced below. The only behavioural change in 1.6.46 is the anti-DNS-rebinding request-Host allowlist (ndaal-sa-2026-288, CVSS v3.1 LOW); the remainder is test-infrastructure and CI-gate hardening that does not alter the shipped viewer's runtime behaviour beyond that allowlist. Versions 1.6.44 and 1.6.45 were interim build cuts folded into this 1.6.46 announcement — no separate product or vulnerability entries are claimed for them."
      },
      {
        "category": "general",
        "text": "Upgrade to grundschutz-oscal-viewer 1.6.46. Operators exposing the viewer beyond loopback should review the new anti-DNS-rebinding request-Host allowlist (`--allowed-host` / `GSV_ALLOWED_HOSTS`) described in ndaal-sa-2026-288 and set it to the hostname(s) the instance is served under."
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
      "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/292/ndaal-sa-2026-292.json"
      },
      {
        "category": "external",
        "summary": "CHANGELOG (1.6.46 section)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-287 (annotation write-path testable sync seams + 16 branch tests; assurance, CVSS 0.0)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/287/ndaal-sa-2026-287.json"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-288 (DNS-rebinding request Host/:authority allowlist on same-origin write endpoints; remediation, CVSS v3.1 LOW)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/288/ndaal-sa-2026-288.json"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-289 (schemathesis contract gate now a real 38-route OpenAPI gate; assurance, CVSS 0.0)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/289/ndaal-sa-2026-289.json"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-290 (cargo-tarpaulin coverage gate now blocking, fails under 80%; assurance, CVSS 0.0)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/290/ndaal-sa-2026-290.json"
      },
      {
        "category": "external",
        "summary": "ndaal-sa-2026-291 (server-stack DoS-mitigation resilience harness: connection-cap + anti-slowloris timeouts; assurance, CVSS 0.0)",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/291/ndaal-sa-2026-291.json"
      },
      {
        "category": "external",
        "summary": "grundschutz-oscal-viewer on crates.io",
        "url": "https://crates.io/crates/grundschutz-oscal-viewer/1.6.46"
      },
      {
        "category": "external",
        "summary": "GitLab release v1.6.46",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.46"
      },
      {
        "category": "external",
        "summary": "ndaal_public_bsi_grundschutz_oscal_viewer repository",
        "url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"
      }
    ],
    "title": "grundschutz-oscal-viewer 1.6.46 — release announcement: anti-DNS-rebinding request-Host allowlist plus a test/assurance hardening pass (testable annotation write-path seams, live schemathesis + cargo-tarpaulin gates, server DoS-mitigation resilience harness); advisories 287–291",
    "tracking": {
      "current_release_date": "2026-07-15T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "ndaal CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ndaal-sa-2026-292",
      "initial_release_date": "2026-07-15T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-15T00:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial advisory: 1.6.46 security + assurance release announcement (anti-DNS-rebinding request-Host allowlist plus test/CI-gate hardening), referencing advisories 287–291. Informational; no vulnerabilities. Status: final."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
        "branches": [
          {
            "category": "product_name",
            "name": "grundschutz-oscal-viewer",
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:cargo/<1.6.46",
                "product": {
                  "name": "grundschutz-oscal-viewer before 1.6.46.",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "1.6.46",
                "product": {
                  "name": "grundschutz-oscal-viewer 1.6.46 — security + assurance release.",
                  "product_id": "CSAFPID-0002"
                }
              }
            ]
          }
        ]
      }
    ]
  }
}