Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.51 was released on 2026-07-30 to GitLab (tag v1.6.51, six checksummed binaries) and to crates.io. The release refreshes the embedded BSI Grundschutz++ catalog to the 2026-07-29 edition and hardens the release binary. It is NOT a vulnerability disclosure: no externally reachable defect was found or fixed, hence the 0.0 / NONE score."
},
{
"category": "description",
"text": "1.6.51 combines a data refresh, defence-in-depth hardening and quality-gate repairs: mimalloc secure allocator as `#[global_allocator]`; `overflow-checks = true` in `[profile; BSI Grundschutz++ catalog refreshed to 2026-07-29 (from 2026-07-03): 190 controls modified, 28 added, 26 removed; 998 -> 1000 controls; Dependency currency; `base64` held at 0; CSAF advisories for the release and each dependency bump; Quality-gate suite repaired — it could not run; Gate runners aimed at the wrong project or the wrong flag; Five edition-pinned assertions repaired after the catalog refresh; The `goose` load-test gate had never actually run; The coverage gate silently rewrote `Cargo; Self-skipping gates no longer report as PASS. The hardening items (a secure allocator and release-profile overflow checks) are preventative measures, not remediations of any known flaw."
},
{
"category": "details",
"text": "Changes recorded in CHANGELOG.md for 1.6.51:\n\nSecurity:\n\n* mimalloc secure allocator as `#[global_allocator]`. Per `skills/rust-hardening`, the process now allocates through mimalloc in `secure` mode: guard pages, randomised placement, encrypted free lists and double-free detection. Safe Rust already prevents these classes in our own code (`forbid(unsafe_code)`), but a global allocator also governs the C allocations inside the FFI dependencies — `aws-lc-sys`, `ring`, `libsqlite3-sys` — which is precisely the code that attribute cannot reach. Those crates already build for all six release targets, so mimalloc's C introduces no new toolchain requirement. Measured cost: release binary 41 536 156 -> 41 723 628 bytes (+187 KB, +0.45 %).\n\n* `overflow-checks = true` in `[profile.release]`. Cargo disables integer overflow checks in release by default, so an overflow would WRAP silently — a wrapped length or offset is a classic logic and memory-safety bug. The crate already denies `clippy::arithmetic_side_effects`, so every arithmetic site is explicitly checked or saturating and a trap should be unreachable; this enforces at runtime what was previously only assumed. NOTE: combined with `panic = \"abort\"`, a genuine overflow terminates the process rather than unwinding — the intended trade-off, stopping on a detected integrity violation instead of continuing with a corrupted value.\n\nChanged:\n\n* BSI Grundschutz++ catalog refreshed to 2026-07-29 (from 2026-07-03): 190 controls modified, 28 added, 26 removed; 998 -> 1000 controls. The changes overlay is regenerated and both `.license` sidecars record the new retrieval. `scripts/update_catalog.sh` needed a URL fix first: BSI restructured their repository, moving the catalog out of `Anwenderkataloge/` into `control_layer/` and renaming it `Grundschutz++-resolved_catalog.json`, so the old URL 404'd. The new file was verified to be the same catalog before switching — identical title and top-level OSCAL keys, newer metadata version.\n\n* Dependency currency. `rustls` 0.23.42 -> 0.23.43 (TLS 1.3 stack for both the HTTPS listener and the Meilisearch client), `http` 1.4.2 -> 1.5.0, `lo_writer` 0.4.8 -> 0.5.2, `lo_zip` 0.4.8 -> 0.5.2 (both pull `lo_core` 0.5.2) and `infer` 0.19 -> 0.22. The `lo_*` and `infer` bumps cross a major version but needed no source change: the APIs this crate uses (`WriterEditor` / `save_as`, `ZipArchive::new` / `ZipEntry::new` / `write_zip_to_vec`, `infer::get`) are unchanged. No duplicate versions enter the graph, so `clippy::multiple_crate_versions` stays satisfied.\n\n* `base64` held at 0.22 deliberately. 0.23.0 is available, but `pem` (via `rcgen`) and `ureq`/`ureq-proto` (via `self_update`) still require 0.22, so upgrading ours leaves BOTH versions in the graph permanently and fails the `clippy -D warnings` gate on `multiple_crate_versions`. Blocked upstream, not by this crate; revisit when those dependencies adopt 0.23.\n\nAdded:\n\n* CSAF advisories for the release and each dependency bump. `ndaal-sa-2026-366` records the 1.6.50 release itself; `367` (rustls), `368` (http), `369` (lo_writer 0.4.10), `370` (lo_writer 0.5.2), `371` (lo_zip) and `372` (infer) record the dependency bumps. `370` supersedes `369`: that advisory recorded the intermediate 0.4.10 step before the dependency was taken to 0.5.2, and is left as published rather than rewritten. All are scored CVSS v3.1 0.0 / v4.0 0.0 (NONE) — verified against the RUSTSEC database rather than assumed: rustls RUSTSEC-2024-0336 (patched >= 0.23.5) and RUSTSEC-2024-0399 (patched >= 0.23.18) both predate 0.23.42, http RUSTSEC-2019-0033/0034 are patched >= 0.1.20 and apply to the 0.1.x line only, and `lo_writer` has never carried an advisory. They are therefore dependency-CURRENCY records, not security fixes. Each ships five tri-tool-verified hash sidecars; the distribution index is regenerated.\n\nFixed:\n\n* Quality-gate suite repaired — it could not run. Landed during the 1.6.50 cycle but recorded here, as 1.6.50 was already published. The tree did not compile (a deleted `[dev-dependencies]` section, a missing `chacha20poly1305` `rand_core` feature, a downgraded `tracing-subscriber` in the lockfile, and a `String` passed where `tracing` needs `&str`); once it did, ten gate runners were broken or unusable. The dominant cause was runners handing a whole-tree path to a file-walking tool: this worktree carries a >150 GB `target/`, so `rust_guardian` spun 1 h 38 min at 99 % CPU without emitting a finding, `codesearch` 68 min, `mkdlint` 11 min, and `typos` produced ~52 000 hits from build output. Each now analyses first-party source (`crates/` then `src/`) and completes in seconds.\n\n* Gate runners aimed at the wrong project or the wrong flag. `cargo_cyclonedx` assumed a `crates/` workspace and a stale SBOM filename; `cargo_auditable` and `foxguard` built the sibling project's packages; `csaf_ndaal` resolved `${PROJECT_ROOT}/../csaf`, a sibling-repo layout, so all 354 advisories reported \"missing\"; and `pmat` had three defects that left it unable to report at all — it read `--mode`'s possible values instead of `--format`'s, passed the scan path positionally to a subcommand that accepts none, and parsed the grade \"D\" out of the heading \"Grade Distribution\". `bandit`, `gitleaks` and `betterleaks` walked the same 150 GB tree, `gitleaks` eight times over (once per output format per pass); all three now scan only first-party source.\n\n* Five edition-pinned assertions repaired after the catalog refresh. Three in `src/changes.rs` (the version window, the 100/81 -> 190/28 change counts, and the `GC.1.2` \"added\" exemplar plus `GC.2.2`'s previous-statement excerpt), one in `tests/features/change_tracking.feature` and one in `tests/test_bdd_inner.rs`. The latter two both used `BER.3.1.1`, which was *added* in 2026-07-03 but *removed* in 2026-07-29, so it no longer carries a change record at all; both now use `BER.5.1.1`. These assertions are inherently coupled to the catalog edition — every future refresh needs the same maintenance. All five were surfaced by `cargo mutants` aborting with \"cargo test failed in an unmutated tree\", the mutation baseline acting as a canary for edition drift.\n\n* The `goose` load-test gate had never actually run. It probed `vl-web`, the sibling product, at `https://127.0.0.1:8080/api/v1/system/health`, so it self-skipped on every sweep. Repointed to this project's listener (8228, from `Cargo.toml`'s `default-port`) and to `/healthz`, which this app serves. With it finally running it failed for real — 960 of 16 160 requests erroring (5.94% against a 1% threshold), all `GET /control/{id}` — because `loadtest/data/control_ids.txt` was a stale snapshot: 17 of 40 sampled ids 404'd after the refresh. Regenerated from the catalog the app serves (983 -> 1000 ids, 30/30 sampled verified); the gate now passes.\n\n* The coverage gate silently rewrote `Cargo.toml`. `test_bash_with_kcov.sh` measures coverage by EXECUTING every runner, documented as using \"each script's side-effect-free `--help` code path\". `test_cargo_fmt_toml.sh` had no argument parsing at all, so `--help` was ignored and it ran its full body — including a `cargo fmt-toml` apply pass that rewrote the manifest, stripping ~123 lines of maintainer rationale and leaving `Cargo.toml_<TIMESTAMP>.backup` files behind. That script is not even in `ALL_GATES`; it only ever ran as collateral. `--help` now exits before anything is touched and the mutating pass is opt-in (`--apply` / `CARGO_FMT_TOML_APPLY=1`), while the coverage gate only measures runners that actually advertise `--help`. The assumption was broadly false: 111 of 237 runners have none, so all of them were being executed for real — including runners that build, publish, scan and restart servers.\n\n* Self-skipping gates no longer report as PASS. `run_cmd` recorded any runner exiting 0 as a pass, but every runner self-skips with exit 0 when its tool is absent or there is nothing to check. The suite header promises \"a missing tool or runner is a SKIP (exit-neutral)\"; the summary did not honour it, so the pass count overstated how much had actually been verified. The summary now surfaces the runner's own verdict — measured across six gates, `h3spec`, `quic_interop` and `rust_cli_with_trycmd` flip PASS -> SKIP while `fmt` and `typos` stay PASS.\n"
},
{
"category": "general",
"text": "Recommended action: upgrade to 1.6.51 for the refreshed catalog (190 controls modified, 28 added, 26 removed; 998 -> 1000 controls) and the hardened binary. No security fix is required. Prebuilt binaries for six targets plus grundschutz-oscal-viewer-1.6.51-SHA256SUMS.txt are attached to the GitLab release; verify the checksum before deployment.\n\nOPERATIONAL NOTE for anyone tracking this catalog: assertions that pin a catalog edition (change-overlay counts, specific 'added' control ids) are invalidated by every refresh. Five such assertions needed updating in this release."
},
{
"category": "other",
"text": "CVSS applicability: scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE). This is a release, catalog-currency and hardening record, not a newly disclosed vulnerability and not a fix for one. Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/373/ndaal-sa-2026-373.json"
},
{
"category": "external",
"summary": "GitLab release v1.6.51 (binaries + SHA256SUMS)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.51"
},
{
"category": "external",
"summary": "grundschutz-oscal-viewer 1.6.51 on crates.io",
"url": "https://crates.io/crates/grundschutz-oscal-viewer/1.6.51"
},
{
"category": "external",
"summary": "CHANGELOG.md (source of this advisory's details)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/v1.6.51/CHANGELOG.md"
},
{
"category": "external",
"summary": "BSI Stand-der-Technik-Bibliothek (catalog upstream)",
"url": "https://github.com/BSI-Bund/Stand-der-Technik-Bibliothek"
}
],
"title": "grundschutz-oscal-viewer 1.6.51: catalog refresh 2026-07-29 + binary hardening; no vulnerability",
"tracking": {
"current_release_date": "2026-07-30T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-373",
"initial_release_date": "2026-07-30T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-30T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: 1.6.51 release record (catalog refresh + hardening). CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "grundschutz-oscal-viewer",
"branches": [
{
"category": "product_version",
"name": "1.6.50 (2026-07-29, previous release)",
"product": {
"name": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50 (catalog 2026-07-03, 998 controls).",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "1.6.51 (2026-07-30, this release)",
"product": {
"name": "BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.51 (catalog 2026-07-29, 1000 controls).",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "This advisory records a RELEASE together with a data refresh and preventative hardening, not a vulnerability remediation. Nothing in 1.6.51 fixes an externally reachable defect, and no CVE or RUSTSEC advisory applies -- hence the 0.0 / NONE score."
},
{
"category": "details",
"text": "Hardening in this release: mimalloc in secure mode as the process-wide #[global_allocator] (guard pages, randomised placement, encrypted free lists, double-free detection), covering the C allocations in the FFI dependencies that forbid(unsafe_code) cannot reach; and overflow-checks enabled in the release profile so a detected integer overflow traps rather than wrapping silently. mimalloc is scoped to non-Windows targets: its C sources expand __DATE__/__TIME__, which the zig cross-compiler rejects under -Werror,-Wdate-time, and Windows already provides a hardened heap."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Track grundschutz-oscal-viewer 1.6.51 (CSAFPID-0002) for the refreshed catalog and the hardened binary; no security fix is required.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"threats": [
{
"category": "impact",
"details": "No security impact (CVSS 0.0 / NONE); 1.6.51 is a release, catalog-currency and hardening record."
}
],
"title": "No vulnerability — 1.6.51 release, catalog-currency and hardening record"
}
]
}