Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50 was released on 2026-07-29 to GitLab (tag v1.6.50, six signed-checksum binaries) and to crates.io. This is an assurance-hardening release record, not a vulnerability disclosure: the changes are test- and verification-side only. No externally reachable defect was found or fixed, hence the 0.0 / NONE score."
},
{
"category": "description",
"text": "Release 1.6.50 deepens the verification surface rather than changing runtime behaviour. Per CHANGELOG.md the entire release falls under 'Tests': Fourth fuzzing engine: cargo-afl (AFL++); bolero unified front-end (+ Kani); Compiler-sanitizer gate (ASan/TSan/LSan/MSan); Unblocked the full crate-wide `cargo-mutants` baseline; Closed all 34 remaining gaps in proptest/fuzz coverage across the crate's untrusted-input-processing surface, following the audit protocol from `skills/rust-fuzzing`/`skills/property-based-testing`: 9 new `proptest!` cases in `tests/proptest_invariants; Synced the remaining ~61 `tests/scripts/` gate runners from vulnerability-lookup-rs, completing the \"full adapt\" sync (each script rewritten to this app's single-binary, single-port-8228, no-HTTP/3 shape rather than copied verbatim). No source change to the shipped request-handling paths is part of this release."
},
{
"category": "details",
"text": "Changes recorded in CHANGELOG.md for 1.6.50:\n\n* Fourth fuzzing engine: cargo-afl (AFL++). Per the updated `skills/rust-fuzzing` four-engine policy, added a standalone `afl/` crate (its own `[workspace]` + lockfile, isolated like `fuzz/` / `hfuzz/` / `loom-harness/`) with one AFL++ target per surface — 53 `afl_<mod>.rs` wrappers, each a thin `fn main() { afl::fuzz!(|d| grundschutz_fuzz_harness::<mod>::fuzz_drive(d)); }` over the SAME single-source `fuzz_drive` body already shared by the libFuzzer (`fuzz/`), honggfuzz (`hfuzz/`), and test-fuzz (`tf_*`) engines. AFL++ adds a genetic-algorithm + edge-coverage mutator distinct from libFuzzer's and honggfuzz's, so it reaches inputs the other three miss (OSS-Fuzz-style ensemble fuzzing); a parser change still lands once in `fuzz_drive` and all four engines pick it up. New nightly `cargo_afl` quality gate (build-check via `cargo afl build`; self-skips until `cargo-afl` + its one-time `cargo afl config --build` runtime are present). `afl/target/` is gitignored.\n\n* bolero unified front-end (+ Kani). Added the go-forward pilot from `skills/rust-fuzzing` §5 at `tests/bolero_fuzz.rs`: three `bolero::check!()` harnesses over the crate's own public untrusted-input surfaces (`changes::CatalogChanges::from_json`, `i18n::resolve`, `updater::parse_sha256sums`). A plain `cargo test` replays the committed corpus as an ordinary test (3/3 green); `cargo bolero test <name> --engine afl|honggfuzz|kani` drives the SAME body under any coverage-guided engine or model-checks it with Kani. Additive to — not a replacement for — the four per-engine wrappers. `bolero` is a new dev-dependency (pulls bolero-engine / -generator / -libfuzzer / -kani); the nightly supply-chain gates (`cargo-vet` / `cargo-deny`) will need those crates covered.\n\n* Compiler-sanitizer gate (ASan/TSan/LSan/MSan). New `tests/scripts/test_sanitizers.sh` builds and runs the library test suite under each of the four `-Z sanitizer` nightly instrumentations in turn (self-skips per-sanitizer when the target/toolchain combination doesn't support it). Scoped to `--lib` — the `bdd` cucumber integration binary fails to link under ASan and is unrelated to the sanitizer surface, so it's excluded rather than silently broken. Fixed a real `IFS=\\n\\t'` word-splitting bug in the script's own sanitizer-list parsing (the canonical boilerplate's IFS has no space, so a bare `for kind in ${SANITIZERS}` never actually split) — three call sites rewritten as `IFS=' \\t\\n' read -r -a arr <<< \"${VAR}\"`. A real run is clean: 36/36 tests pass under every sanitizer. Wired into `scripts/quality_gates.sh` as the `sanitizers` gate (Heavy/nightly).\n\n* Unblocked the full crate-wide `cargo-mutants` baseline. The mutation gate's baseline build was hanging indefinitely inside cargo-mutants' scratch-tree copy — proptest's `FileFailurePersistence::SourceParallel` walk-up (looking for `lib.rs`/`main.rs`) never resolves correctly there. Pinned it instead to `FileFailurePersistence::Direct(...)` with a `CARGO_MANIFEST_DIR`-derived absolute path in `tests/proptest_invariants.rs`, verified against a real scoped `cargo mutants --file src/i18n.rs` run completing its baseline.\n\n* Closed all 34 remaining gaps in proptest/fuzz coverage across the crate's untrusted-input-processing surface, following the audit protocol from `skills/rust-fuzzing`/`skills/property-based-testing`: 9 new `proptest!` cases in `tests/proptest_invariants.rs` (export format parsing, catalog JSON loading, CA-cert loading, archive install, annotation search, SQL-dump restore round-trip, export artifact/download building, PDF rendering) plus 23 new fuzz-harness modules under `fuzz-harness/src/` — each mirrored across all three engines (`fuzz/`, `hfuzz/`, `afl/`) via a new `scratchpad/generate_harness.py` generator. New coverage includes the three `/annotations/*` POST-handler seams (save/preview/upload), the export/DB-dump/dump-delete handlers, dump-file listing, image-asset storage, bulk template replacement, and the operator `--mappings-dir` loader. Two real bugs surfaced and were fixed while writing the tests, not just gap-filled: `export_pdf::Block` was missing `#[derive(Debug)]` (proptest requires `Debug` on generated parameters — a genuine compile error), and `routes::annotation::same_origin` was needlessly `pub(crate)`, blocking the CSRF-critical function from being fuzzed externally (widened to `#[must_use] pub`).\n\n* Synced the remaining ~61 `tests/scripts/` gate runners from vulnerability-lookup-rs, completing the \"full adapt\" sync (each script rewritten to this app's single-binary, single-port-8228, no-HTTP/3 shape rather than copied verbatim). Wave 1 (33 scripts: `arch_graphs`, `cargo_acl`, `cargo_deadlinks`, `cargo_goggles`, `cargo_hack`, `cargo_minimal_versions`, `cargo_unmaintained`, `cargo_valgrind`, `charybdefs`, `creusot`, `css_with_stylelint`, `deductive_verification`, `flux`, `hotspots_cli`, `html_with_vnu`, `mirai`, `prusti`, `pumba`, `python_with_codeql`, `python_with_pylyzer`, `radamsa`, `ramparts`, `ripr`, `rust_with_codeql`, `rust_with_hela`, `sql_with_sqlness_cli`, `sqlite_integrity`, `sqllogictest_bin`, `stateright`, `taudit`, `turmoil`, `valgrind_extra`, `verus`) and wave 2 (28 scripts: `blint`, `bruno_dashboard_coverage`, `cats`, `dashboard_field_distinctness`, `dm_crash_consistency`, `h3spec`, `http_garden`, `interactsh`, `jonesy`, `katana`, `libfiu`, `oasdiff`, `promtool`, `protocol_abuse`, `quic_interop`, `reproducible_build`, `restler`, `rust_cli_with_assert_cmd`, `rust_cli_with_snapbox`, `rust_cli_with_trycmd`, `rustwright`, `soak`, `spectral`, `sql_with_sqlfluff`, `stress_ng`, `tlsfuzzer`, `toxiproxy`, `vacuum`) bring `scripts/quality_gates.sh` from 133 to 194 registered gates. Five candidates were confirmed as pre-existing duplicates and skipped rather than re-added (`betterleaks`/`gitleaks`/`leaktor`/`pyscan` gates already exist under those names; `hateoas_compliance_vulnlookup` duplicates the already-active `hateoas_compliance_grundschutz`). `h3spec`/`quic_interop` self-skip honestly — this app has no HTTP/3/QUIC listener (see the \"Port 8181 / HTTP/3\" note). The 3 `rust_cli_with_*` golden-file gates self-skip until `trycmd`/`snapbox`/`assert_cmd` become dev-dependencies. 13 of the wave-2 LIVE gates were retrofitted with an opt-in `*_STRICT` env var (default report-only) to match this repo's established `apihunter`/`pumba`-style convention for live DAST/chaos gates, rather than always exiting 0."
},
{
"category": "general",
"text": "Recommended action: none required for security. Operators may upgrade to 1.6.50 for the assurance improvements. Prebuilt binaries for six targets plus grundschutz-oscal-viewer-1.6.50-SHA256SUMS.txt are attached to the GitLab release; verify the checksum before deployment. The crate is on crates.io as grundschutz-oscal-viewer 1.6.50."
},
{
"category": "other",
"text": "CVSS applicability: scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE). This is a release/assurance record covering test and verification tooling, not a newly disclosed vulnerability and not a fix for one. Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/366/ndaal-sa-2026-366.json"
},
{
"category": "external",
"summary": "GitLab release v1.6.50 (binaries + SHA256SUMS)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.50"
},
{
"category": "external",
"summary": "grundschutz-oscal-viewer 1.6.50 on crates.io",
"url": "https://crates.io/crates/grundschutz-oscal-viewer/1.6.50"
},
{
"category": "external",
"summary": "CHANGELOG.md (source of this advisory's details)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/v1.6.50/CHANGELOG.md"
}
],
"title": "grundschutz-oscal-viewer 1.6.50: release + test-assurance hardening; no vulnerability",
"tracking": {
"current_release_date": "2026-07-29T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-366",
"initial_release_date": "2026-07-29T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-29T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: 1.6.50 release record (test-assurance hardening). CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "grundschutz-oscal-viewer",
"branches": [
{
"category": "product_version",
"name": "1.6.49 (2026-07-22, previous release)",
"product": {
"name": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.49.",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "1.6.50 (2026-07-29, this release)",
"product": {
"name": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50.",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "This advisory records a RELEASE and its assurance improvements, not a vulnerability remediation. Nothing in 1.6.50 fixes an externally reachable defect, and no CVE or RUSTSEC advisory applies -- hence the 0.0 / NONE score."
},
{
"category": "details",
"text": "Verification accompanying this release: four independent fuzzing engines (libFuzzer, honggfuzz, test-fuzz, AFL++) over a single shared fuzz_drive body, a bolero front-end that also model-checks with Kani, a compiler-sanitizer gate (ASan/TSan/LSan/MSan), a restored crate-wide cargo-mutants baseline, and closure of the 34 remaining proptest/fuzz coverage gaps."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Track grundschutz-oscal-viewer 1.6.50 (CSAFPID-0002) for the assurance improvements; no security fix is required.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"threats": [
{
"category": "impact",
"details": "No security impact (CVSS 0.0 / NONE); 1.6.50 is a release + test-assurance record."
}
],
"title": "No vulnerability — 1.6.50 release / test-assurance record"
}
]
}