{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50 was released on 2026-07-29 to GitLab (tag v1.6.50, six signed-checksum binaries) and to crates.io. This is an assurance-hardening release record, not a vulnerability disclosure: the changes are test- and verification-side only. No externally reachable defect was found or fixed, hence the 0.0 / NONE score."},{"category":"description","text":"Release 1.6.50 deepens the verification surface rather than changing runtime behaviour. Per CHANGELOG.md the entire release falls under 'Tests': Fourth fuzzing engine: cargo-afl (AFL++); bolero unified front-end (+ Kani); Compiler-sanitizer gate (ASan/TSan/LSan/MSan); Unblocked the full crate-wide `cargo-mutants` baseline; Closed all 34 remaining gaps in proptest/fuzz coverage across the crate's untrusted-input-processing surface, following the audit protocol from `skills/rust-fuzzing`/`skills/property-based-testing`: 9 new `proptest!` cases in `tests/proptest_invariants; Synced the remaining ~61 `tests/scripts/` gate runners from vulnerability-lookup-rs, completing the \"full adapt\" sync (each script rewritten to this app's single-binary, single-port-8228, no-HTTP/3 shape rather than copied verbatim). No source change to the shipped request-handling paths is part of this release."},{"category":"details","text":"Changes recorded in CHANGELOG.md for 1.6.50:\n\n* Fourth fuzzing engine: cargo-afl (AFL++). Per the updated `skills/rust-fuzzing` four-engine policy, added a standalone `afl/` crate (its own `[workspace]` + lockfile, isolated like `fuzz/` / `hfuzz/` / `loom-harness/`) with one AFL++ target per surface — 53 `afl_<mod>.rs` wrappers, each a thin `fn main() { afl::fuzz!(|d| grundschutz_fuzz_harness::<mod>::fuzz_drive(d)); }` over the SAME single-source `fuzz_drive` body already shared by the libFuzzer (`fuzz/`), honggfuzz (`hfuzz/`), and test-fuzz (`tf_*`) engines. AFL++ adds a genetic-algorithm + edge-coverage mutator distinct from libFuzzer's and honggfuzz's, so it reaches inputs the other three miss (OSS-Fuzz-style ensemble fuzzing); a parser change still lands once in `fuzz_drive` and all four engines pick it up. New nightly `cargo_afl` quality gate (build-check via `cargo afl build`; self-skips until `cargo-afl` + its one-time `cargo afl config --build` runtime are present). `afl/target/` is gitignored.\n\n* bolero unified front-end (+ Kani). Added the go-forward pilot from `skills/rust-fuzzing` §5 at `tests/bolero_fuzz.rs`: three `bolero::check!()` harnesses over the crate's own public untrusted-input surfaces (`changes::CatalogChanges::from_json`, `i18n::resolve`, `updater::parse_sha256sums`). A plain `cargo test` replays the committed corpus as an ordinary test (3/3 green); `cargo bolero test <name> --engine afl|honggfuzz|kani` drives the SAME body under any coverage-guided engine or model-checks it with Kani. Additive to — not a replacement for — the four per-engine wrappers. `bolero` is a new dev-dependency (pulls bolero-engine / -generator / -libfuzzer / -kani); the nightly supply-chain gates (`cargo-vet` / `cargo-deny`) will need those crates covered.\n\n* Compiler-sanitizer gate (ASan/TSan/LSan/MSan). New `tests/scripts/test_sanitizers.sh` builds and runs the library test suite under each of the four `-Z sanitizer` nightly instrumentations in turn (self-skips per-sanitizer when the target/toolchain combination doesn't support it). Scoped to `--lib` — the `bdd` cucumber integration binary fails to link under ASan and is unrelated to the sanitizer surface, so it's excluded rather than silently broken. Fixed a real `IFS=\\n\\t'` word-splitting bug in the script's own sanitizer-list parsing (the canonical boilerplate's IFS has no space, so a bare `for kind in ${SANITIZERS}` never actually split) — three call sites rewritten as `IFS=' \\t\\n' read -r -a arr <<< \"${VAR}\"`. A real run is clean: 36/36 tests pass under every sanitizer. Wired into `scripts/quality_gates.sh` as the `sanitizers` gate (Heavy/nightly).\n\n* Unblocked the full crate-wide `cargo-mutants` baseline. The mutation gate's baseline build was hanging indefinitely inside cargo-mutants' scratch-tree copy — proptest's `FileFailurePersistence::SourceParallel` walk-up (looking for `lib.rs`/`main.rs`) never resolves correctly there. Pinned it instead to `FileFailurePersistence::Direct(...)` with a `CARGO_MANIFEST_DIR`-derived absolute path in `tests/proptest_invariants.rs`, verified against a real scoped `cargo mutants --file src/i18n.rs` run completing its baseline.\n\n* Closed all 34 remaining gaps in proptest/fuzz coverage across the crate's untrusted-input-processing surface, following the audit protocol from `skills/rust-fuzzing`/`skills/property-based-testing`: 9 new `proptest!` cases in `tests/proptest_invariants.rs` (export format parsing, catalog JSON loading, CA-cert loading, archive install, annotation search, SQL-dump restore round-trip, export artifact/download building, PDF rendering) plus 23 new fuzz-harness modules under `fuzz-harness/src/` — each mirrored across all three engines (`fuzz/`, `hfuzz/`, `afl/`) via a new `scratchpad/generate_harness.py` generator. New coverage includes the three `/annotations/*` POST-handler seams (save/preview/upload), the export/DB-dump/dump-delete handlers, dump-file listing, image-asset storage, bulk template replacement, and the operator `--mappings-dir` loader. Two real bugs surfaced and were fixed while writing the tests, not just gap-filled: `export_pdf::Block` was missing `#[derive(Debug)]` (proptest requires `Debug` on generated parameters — a genuine compile error), and `routes::annotation::same_origin` was needlessly `pub(crate)`, blocking the CSRF-critical function from being fuzzed externally (widened to `#[must_use] pub`).\n\n* Synced the remaining ~61 `tests/scripts/` gate runners from vulnerability-lookup-rs, completing the \"full adapt\" sync (each script rewritten to this app's single-binary, single-port-8228, no-HTTP/3 shape rather than copied verbatim). Wave 1 (33 scripts: `arch_graphs`, `cargo_acl`, `cargo_deadlinks`, `cargo_goggles`, `cargo_hack`, `cargo_minimal_versions`, `cargo_unmaintained`, `cargo_valgrind`, `charybdefs`, `creusot`, `css_with_stylelint`, `deductive_verification`, `flux`, `hotspots_cli`, `html_with_vnu`, `mirai`, `prusti`, `pumba`, `python_with_codeql`, `python_with_pylyzer`, `radamsa`, `ramparts`, `ripr`, `rust_with_codeql`, `rust_with_hela`, `sql_with_sqlness_cli`, `sqlite_integrity`, `sqllogictest_bin`, `stateright`, `taudit`, `turmoil`, `valgrind_extra`, `verus`) and wave 2 (28 scripts: `blint`, `bruno_dashboard_coverage`, `cats`, `dashboard_field_distinctness`, `dm_crash_consistency`, `h3spec`, `http_garden`, `interactsh`, `jonesy`, `katana`, `libfiu`, `oasdiff`, `promtool`, `protocol_abuse`, `quic_interop`, `reproducible_build`, `restler`, `rust_cli_with_assert_cmd`, `rust_cli_with_snapbox`, `rust_cli_with_trycmd`, `rustwright`, `soak`, `spectral`, `sql_with_sqlfluff`, `stress_ng`, `tlsfuzzer`, `toxiproxy`, `vacuum`) bring `scripts/quality_gates.sh` from 133 to 194 registered gates. Five candidates were confirmed as pre-existing duplicates and skipped rather than re-added (`betterleaks`/`gitleaks`/`leaktor`/`pyscan` gates already exist under those names; `hateoas_compliance_vulnlookup` duplicates the already-active `hateoas_compliance_grundschutz`). `h3spec`/`quic_interop` self-skip honestly — this app has no HTTP/3/QUIC listener (see the \"Port 8181 / HTTP/3\" note). The 3 `rust_cli_with_*` golden-file gates self-skip until `trycmd`/`snapbox`/`assert_cmd` become dev-dependencies. 13 of the wave-2 LIVE gates were retrofitted with an opt-in `*_STRICT` env var (default report-only) to match this repo's established `apihunter`/`pumba`-style convention for live DAST/chaos gates, rather than always exiting 0."},{"category":"general","text":"Recommended action: none required for security. Operators may upgrade to 1.6.50 for the assurance improvements. Prebuilt binaries for six targets plus grundschutz-oscal-viewer-1.6.50-SHA256SUMS.txt are attached to the GitLab release; verify the checksum before deployment. The crate is on crates.io as grundschutz-oscal-viewer 1.6.50."},{"category":"other","text":"CVSS applicability: scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE). This is a release/assurance record covering test and verification tooling, not a newly disclosed vulnerability and not a fix for one. Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/366/ndaal-sa-2026-366.json"},{"category":"external","summary":"GitLab release v1.6.50 (binaries + SHA256SUMS)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.50"},{"category":"external","summary":"grundschutz-oscal-viewer 1.6.50 on crates.io","url":"https://crates.io/crates/grundschutz-oscal-viewer/1.6.50"},{"category":"external","summary":"CHANGELOG.md (source of this advisory's details)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/v1.6.50/CHANGELOG.md"}],"title":"grundschutz-oscal-viewer 1.6.50: release + test-assurance hardening; no vulnerability","tracking":{"current_release_date":"2026-07-29T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-366","initial_release_date":"2026-07-29T00:00:00.000Z","revision_history":[{"date":"2026-07-29T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory: 1.6.50 release record (test-assurance hardening). CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"grundschutz-oscal-viewer","branches":[{"category":"product_version","name":"1.6.49 (2026-07-22, previous release)","product":{"name":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.49.","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.50 (2026-07-29, this release)","product":{"name":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50.","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"This advisory records a RELEASE and its assurance improvements, not a vulnerability remediation. Nothing in 1.6.50 fixes an externally reachable defect, and no CVE or RUSTSEC advisory applies -- hence the 0.0 / NONE score."},{"category":"details","text":"Verification accompanying this release: four independent fuzzing engines (libFuzzer, honggfuzz, test-fuzz, AFL++) over a single shared fuzz_drive body, a bolero front-end that also model-checks with Kani, a compiler-sanitizer gate (ASan/TSan/LSan/MSan), a restored crate-wide cargo-mutants baseline, and closure of the 34 remaining proptest/fuzz coverage gaps."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Track grundschutz-oscal-viewer 1.6.50 (CSAFPID-0002) for the assurance improvements; no security fix is required.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"threats":[{"category":"impact","details":"No security impact (CVSS 0.0 / NONE); 1.6.50 is a release + test-assurance record."}],"title":"No vulnerability — 1.6.50 release / test-assurance record"}]}