{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.51 was released on 2026-07-30 to GitLab (tag v1.6.51, six checksummed binaries) and to crates.io. The release refreshes the embedded BSI Grundschutz++ catalog to the 2026-07-29 edition and hardens the release binary. It is NOT a vulnerability disclosure: no externally reachable defect was found or fixed, hence the 0.0 / NONE score."},{"category":"description","text":"1.6.51 combines a data refresh, defence-in-depth hardening and quality-gate repairs: mimalloc secure allocator as `#[global_allocator]`; `overflow-checks = true` in `[profile; BSI Grundschutz++ catalog refreshed to 2026-07-29 (from 2026-07-03): 190 controls modified, 28 added, 26 removed; 998 -> 1000 controls; Dependency currency; `base64` held at 0; CSAF advisories for the release and each dependency bump; Quality-gate suite repaired — it could not run; Gate runners aimed at the wrong project or the wrong flag; Five edition-pinned assertions repaired after the catalog refresh; The `goose` load-test gate had never actually run; The coverage gate silently rewrote `Cargo; Self-skipping gates no longer report as PASS. The hardening items (a secure allocator and release-profile overflow checks) are preventative measures, not remediations of any known flaw."},{"category":"details","text":"Changes recorded in CHANGELOG.md for 1.6.51:\n\nSecurity:\n\n* mimalloc secure allocator as `#[global_allocator]`. Per `skills/rust-hardening`, the process now allocates through mimalloc in `secure` mode: guard pages, randomised placement, encrypted free lists and double-free detection. Safe Rust already prevents these classes in our own code (`forbid(unsafe_code)`), but a global allocator also governs the C allocations inside the FFI dependencies — `aws-lc-sys`, `ring`, `libsqlite3-sys` — which is precisely the code that attribute cannot reach. Those crates already build for all six release targets, so mimalloc's C introduces no new toolchain requirement. Measured cost: release binary 41 536 156 -> 41 723 628 bytes (+187 KB, +0.45 %).\n\n* `overflow-checks = true` in `[profile.release]`. Cargo disables integer overflow checks in release by default, so an overflow would WRAP silently — a wrapped length or offset is a classic logic and memory-safety bug. The crate already denies `clippy::arithmetic_side_effects`, so every arithmetic site is explicitly checked or saturating and a trap should be unreachable; this enforces at runtime what was previously only assumed. NOTE: combined with `panic = \"abort\"`, a genuine overflow terminates the process rather than unwinding — the intended trade-off, stopping on a detected integrity violation instead of continuing with a corrupted value.\n\nChanged:\n\n* BSI Grundschutz++ catalog refreshed to 2026-07-29 (from 2026-07-03): 190 controls modified, 28 added, 26 removed; 998 -> 1000 controls. The changes overlay is regenerated and both `.license` sidecars record the new retrieval. `scripts/update_catalog.sh` needed a URL fix first: BSI restructured their repository, moving the catalog out of `Anwenderkataloge/` into `control_layer/` and renaming it `Grundschutz++-resolved_catalog.json`, so the old URL 404'd. The new file was verified to be the same catalog before switching — identical title and top-level OSCAL keys, newer metadata version.\n\n* Dependency currency. `rustls` 0.23.42 -> 0.23.43 (TLS 1.3 stack for both the HTTPS listener and the Meilisearch client), `http` 1.4.2 -> 1.5.0, `lo_writer` 0.4.8 -> 0.5.2, `lo_zip` 0.4.8 -> 0.5.2 (both pull `lo_core` 0.5.2) and `infer` 0.19 -> 0.22. The `lo_*` and `infer` bumps cross a major version but needed no source change: the APIs this crate uses (`WriterEditor` / `save_as`, `ZipArchive::new` / `ZipEntry::new` / `write_zip_to_vec`, `infer::get`) are unchanged. No duplicate versions enter the graph, so `clippy::multiple_crate_versions` stays satisfied.\n\n* `base64` held at 0.22 deliberately. 0.23.0 is available, but `pem` (via `rcgen`) and `ureq`/`ureq-proto` (via `self_update`) still require 0.22, so upgrading ours leaves BOTH versions in the graph permanently and fails the `clippy -D warnings` gate on `multiple_crate_versions`. Blocked upstream, not by this crate; revisit when those dependencies adopt 0.23.\n\nAdded:\n\n* CSAF advisories for the release and each dependency bump. `ndaal-sa-2026-366` records the 1.6.50 release itself; `367` (rustls), `368` (http), `369` (lo_writer 0.4.10), `370` (lo_writer 0.5.2), `371` (lo_zip) and `372` (infer) record the dependency bumps. `370` supersedes `369`: that advisory recorded the intermediate 0.4.10 step before the dependency was taken to 0.5.2, and is left as published rather than rewritten. All are scored CVSS v3.1 0.0 / v4.0 0.0 (NONE) — verified against the RUSTSEC database rather than assumed: rustls RUSTSEC-2024-0336 (patched >= 0.23.5) and RUSTSEC-2024-0399 (patched >= 0.23.18) both predate 0.23.42, http RUSTSEC-2019-0033/0034 are patched >= 0.1.20 and apply to the 0.1.x line only, and `lo_writer` has never carried an advisory. They are therefore dependency-CURRENCY records, not security fixes. Each ships five tri-tool-verified hash sidecars; the distribution index is regenerated.\n\nFixed:\n\n* Quality-gate suite repaired — it could not run. Landed during the 1.6.50 cycle but recorded here, as 1.6.50 was already published. The tree did not compile (a deleted `[dev-dependencies]` section, a missing `chacha20poly1305` `rand_core` feature, a downgraded `tracing-subscriber` in the lockfile, and a `String` passed where `tracing` needs `&str`); once it did, ten gate runners were broken or unusable. The dominant cause was runners handing a whole-tree path to a file-walking tool: this worktree carries a >150 GB `target/`, so `rust_guardian` spun 1 h 38 min at 99 % CPU without emitting a finding, `codesearch` 68 min, `mkdlint` 11 min, and `typos` produced ~52 000 hits from build output. Each now analyses first-party source (`crates/` then `src/`) and completes in seconds.\n\n* Gate runners aimed at the wrong project or the wrong flag. `cargo_cyclonedx` assumed a `crates/` workspace and a stale SBOM filename; `cargo_auditable` and `foxguard` built the sibling project's packages; `csaf_ndaal` resolved `${PROJECT_ROOT}/../csaf`, a sibling-repo layout, so all 354 advisories reported \"missing\"; and `pmat` had three defects that left it unable to report at all — it read `--mode`'s possible values instead of `--format`'s, passed the scan path positionally to a subcommand that accepts none, and parsed the grade \"D\" out of the heading \"Grade Distribution\". `bandit`, `gitleaks` and `betterleaks` walked the same 150 GB tree, `gitleaks` eight times over (once per output format per pass); all three now scan only first-party source.\n\n* Five edition-pinned assertions repaired after the catalog refresh. Three in `src/changes.rs` (the version window, the 100/81 -> 190/28 change counts, and the `GC.1.2` \"added\" exemplar plus `GC.2.2`'s previous-statement excerpt), one in `tests/features/change_tracking.feature` and one in `tests/test_bdd_inner.rs`. The latter two both used `BER.3.1.1`, which was *added* in 2026-07-03 but *removed* in 2026-07-29, so it no longer carries a change record at all; both now use `BER.5.1.1`. These assertions are inherently coupled to the catalog edition — every future refresh needs the same maintenance. All five were surfaced by `cargo mutants` aborting with \"cargo test failed in an unmutated tree\", the mutation baseline acting as a canary for edition drift.\n\n* The `goose` load-test gate had never actually run. It probed `vl-web`, the sibling product, at `https://127.0.0.1:8080/api/v1/system/health`, so it self-skipped on every sweep. Repointed to this project's listener (8228, from `Cargo.toml`'s `default-port`) and to `/healthz`, which this app serves. With it finally running it failed for real — 960 of 16 160 requests erroring (5.94% against a 1% threshold), all `GET /control/{id}` — because `loadtest/data/control_ids.txt` was a stale snapshot: 17 of 40 sampled ids 404'd after the refresh. Regenerated from the catalog the app serves (983 -> 1000 ids, 30/30 sampled verified); the gate now passes.\n\n* The coverage gate silently rewrote `Cargo.toml`. `test_bash_with_kcov.sh` measures coverage by EXECUTING every runner, documented as using \"each script's side-effect-free `--help` code path\". `test_cargo_fmt_toml.sh` had no argument parsing at all, so `--help` was ignored and it ran its full body — including a `cargo fmt-toml` apply pass that rewrote the manifest, stripping ~123 lines of maintainer rationale and leaving `Cargo.toml_<TIMESTAMP>.backup` files behind. That script is not even in `ALL_GATES`; it only ever ran as collateral. `--help` now exits before anything is touched and the mutating pass is opt-in (`--apply` / `CARGO_FMT_TOML_APPLY=1`), while the coverage gate only measures runners that actually advertise `--help`. The assumption was broadly false: 111 of 237 runners have none, so all of them were being executed for real — including runners that build, publish, scan and restart servers.\n\n* Self-skipping gates no longer report as PASS. `run_cmd` recorded any runner exiting 0 as a pass, but every runner self-skips with exit 0 when its tool is absent or there is nothing to check. The suite header promises \"a missing tool or runner is a SKIP (exit-neutral)\"; the summary did not honour it, so the pass count overstated how much had actually been verified. The summary now surfaces the runner's own verdict — measured across six gates, `h3spec`, `quic_interop` and `rust_cli_with_trycmd` flip PASS -> SKIP while `fmt` and `typos` stay PASS.\n"},{"category":"general","text":"Recommended action: upgrade to 1.6.51 for the refreshed catalog (190 controls modified, 28 added, 26 removed; 998 -> 1000 controls) and the hardened binary. No security fix is required. Prebuilt binaries for six targets plus grundschutz-oscal-viewer-1.6.51-SHA256SUMS.txt are attached to the GitLab release; verify the checksum before deployment.\n\nOPERATIONAL NOTE for anyone tracking this catalog: assertions that pin a catalog edition (change-overlay counts, specific 'added' control ids) are invalidated by every refresh. Five such assertions needed updating in this release."},{"category":"other","text":"CVSS applicability: scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE). This is a release, catalog-currency and hardening record, not a newly disclosed vulnerability and not a fix for one. Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/373/ndaal-sa-2026-373.json"},{"category":"external","summary":"GitLab release v1.6.51 (binaries + SHA256SUMS)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.51"},{"category":"external","summary":"grundschutz-oscal-viewer 1.6.51 on crates.io","url":"https://crates.io/crates/grundschutz-oscal-viewer/1.6.51"},{"category":"external","summary":"CHANGELOG.md (source of this advisory's details)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/v1.6.51/CHANGELOG.md"},{"category":"external","summary":"BSI Stand-der-Technik-Bibliothek (catalog upstream)","url":"https://github.com/BSI-Bund/Stand-der-Technik-Bibliothek"}],"title":"grundschutz-oscal-viewer 1.6.51: catalog refresh 2026-07-29 + binary hardening; no vulnerability","tracking":{"current_release_date":"2026-07-30T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-373","initial_release_date":"2026-07-30T00:00:00.000Z","revision_history":[{"date":"2026-07-30T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory: 1.6.51 release record (catalog refresh + hardening). CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"grundschutz-oscal-viewer","branches":[{"category":"product_version","name":"1.6.50 (2026-07-29, previous release)","product":{"name":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.50 (catalog 2026-07-03, 998 controls).","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.51 (2026-07-30, this release)","product":{"name":"BSI Grundschutz++ OSCAL Viewer (grundschutz-oscal-viewer) 1.6.51 (catalog 2026-07-29, 1000 controls).","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"This advisory records a RELEASE together with a data refresh and preventative hardening, not a vulnerability remediation. Nothing in 1.6.51 fixes an externally reachable defect, and no CVE or RUSTSEC advisory applies -- hence the 0.0 / NONE score."},{"category":"details","text":"Hardening in this release: mimalloc in secure mode as the process-wide #[global_allocator] (guard pages, randomised placement, encrypted free lists, double-free detection), covering the C allocations in the FFI dependencies that forbid(unsafe_code) cannot reach; and overflow-checks enabled in the release profile so a detected integer overflow traps rather than wrapping silently. mimalloc is scoped to non-Windows targets: its C sources expand __DATE__/__TIME__, which the zig cross-compiler rejects under -Werror,-Wdate-time, and Windows already provides a hardened heap."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Track grundschutz-oscal-viewer 1.6.51 (CSAFPID-0002) for the refreshed catalog and the hardened binary; no security fix is required.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"threats":[{"category":"impact","details":"No security impact (CVSS 0.0 / NONE); 1.6.51 is a release, catalog-currency and hardening record."}],"title":"No vulnerability — 1.6.51 release, catalog-currency and hardening record"}]}