{ "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json", "document": { "category": "csaf_security_advisory", "csaf_version": "2.1", "distribution": { "tlp": { "label": "CLEAR" } }, "lang": "en", "notes": [ { "category": "summary", "text": "ndaal SARIF Viewer 1.1.11 is affected by RUSTSEC-2026-0285 (GHSA-2mjx-qc3c-rqvc). ndaal SARIF Viewer 1.1.12 remediates it by advancing the `rustls` dependency 0.23.42 -> 0.23.45 in the 2026-09-16 `cargo update` sweep. CVSS v3.1 base score 5.3 (MEDIUM). Users of 1.1.11 and earlier releases resolving the affected version should upgrade to 1.1.12.", "title": "Summary" }, { "category": "description", "text": "rustls accepted a TLS 1.3 handshake message sent at the wrong encryption level when it followed a key-changing message inside the same record -- for example a plaintext EncryptedExtensions packed into the ServerHello record. RFC 8446 section 5.1 requires such a connection to be terminated with an unexpected_message alert. The handshake transcript remains authenticated, so a network-position attacker can neither alter nor complete a handshake through this flaw; the practical effect is that a peer could send handshake messages in plaintext that should have been encrypted without rustls rejecting the connection. For sarif-viewer the affected code is on the primary trust boundary: every request to the viewer's listener is terminated by this rustls version. Upstream notes the flaw is functionally the same as Go's GO-2026-4340 (CVE-2025-61730); that CVE is recorded here as related context only and is NOT an alias assigned to the rustls advisory. Versions below 0.23.13 are unaffected upstream; sarif-viewer 1.1.11 shipped 0.23.42 and is therefore affected.", "title": "Impact" }, { "category": "general", "text": "The CVSS v3.1 vector is the one published in the RUSTSEC advisory, not an ndaal re-assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3 (MEDIUM). The confidentiality-only LOW impact reflects that protocol messages intended to be encrypted could be accepted in the clear, while authentication and integrity of the handshake transcript hold. The v4.0 vector is derived from it by this repository's documented v3-to-v4 mapping so that both metrics describe the same finding. Note that the derived v4.0 vector computes 6.9 (MEDIUM) against the upstream v3.1 score of 5.3 (MEDIUM) for the same metric values: the uplift is inherent to how CVSS 4.0 weights an unauthenticated, network-reachable confidentiality impact and is not a second ndaal assessment of the flaw.", "title": "CVSS Scoring Rationale" }, { "category": "general", "text": "rustls terminates TLS 1.3 for the viewer's HTTPS listener (src/tls.rs, src/server.rs), configured with default-features off plus the aws_lc_rs provider, prefer-post-quantum key exchange, logging and std. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"0.23\"; lockfile-only change. 0.23.45 is the first release in the 0.23 line carrying the fix for RUSTSEC-2026-0285. Folds the matching lockfile advances in the same TLS subtree: rustls-pki-types 1.15.0 -> 1.15.1, rustls-webpki 0.103.13 -> 0.103.15, and the aws-lc-rs cryptographic provider 1.17.1 -> 1.18.1 with its aws-lc-sys bindings 0.42.0 -> 0.45.0. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.", "title": "Dependency Change" }, { "category": "general", "text": "sarif-viewer is a secure, memory-safe, single-binary offline viewer, validator and multi-format exporter for SARIF 2.1.0 and SARIF 2.2 (draft). Imported runs are validated against the vendored OASIS schemas (jsonschema) and served from an embedded UI over a TLS 1.3 listener (rustls with the aws-lc-rs provider and prefer-post-quantum key exchange) that speaks HTTP/1.1 and HTTP/2 through hyper-util's auto builder (src/server.rs) and HTTP/3 through h3 over quinn. Filesystem access for import, export and checksum sidecars is confined with cap-std. Its network-reachable request parsing surface, its TLS termination, and its supply chain are on the primary trust boundary.", "title": "Product Description" }, { "category": "legal_disclaimer", "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.", "title": "Legal Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "security@ndaal.eu", "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team", "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG", "namespace": "https://ndaal.eu/csaf" }, "references": [ { "category": "self", "summary": "This advisory in CSAF 2.1 format", "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/629/ndaal-sa-2026-629.json" }, { "category": "external", "summary": "sarif-viewer source code", "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer" }, { "category": "external", "summary": "sarif-viewer on crates.io", "url": "https://crates.io/crates/sarif-viewer" }, { "category": "external", "summary": "rustls 0.23.45 on crates.io", "url": "https://crates.io/crates/rustls/0.23.45" }, { "category": "external", "summary": "RUSTSEC-2026-0285 in the RustSec advisory database", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0285" }, { "category": "external", "summary": "Upstream advisory GHSA-2mjx-qc3c-rqvc", "url": "https://github.com/advisories/GHSA-2mjx-qc3c-rqvc" } ], "title": "ndaal Security Advisory: RUSTSEC-2026-0285 remediated in sarif-viewer 1.1.12 via rustls 0.23.42 -> 0.23.45", "tracking": { "current_release_date": "2026-09-16T12:00:00.000Z", "generator": { "engine": { "name": "ndaal CSAF Generator", "version": "1.0.0" } }, "id": "ndaal-sa-2026-629", "initial_release_date": "2026-09-16T12:00:00.000Z", "revision_history": [ { "date": "2026-09-16T12:00:00.000Z", "number": "1.0.0", "summary": "RUSTSEC-2026-0285 remediated via rustls 0.23.42 -> 0.23.45; CVSS v3.1 5.3 (MEDIUM)" } ], "status": "final", "version": "1.0.0" }, "x_extensions": [ { "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json", "category": "informational", "content": { "dashboard_short_name": "ndaal", "publisher_brand": "ndaal Advisories Database" }, "critical": false } ] }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "1.1.11", "product": { "name": "ndaal SARIF Viewer 1.1.11", "product_id": "CSAFPID-0001", "product_identification_helper": { "purls": [ "pkg:cargo/sarif-viewer@1.1.11" ] } } }, { "category": "product_version", "name": "1.1.12", "product": { "name": "ndaal SARIF Viewer 1.1.12", "product_id": "CSAFPID-0002", "product_identification_helper": { "purls": [ "pkg:cargo/sarif-viewer@1.1.12" ] } } } ], "category": "product_name", "name": "sarif-viewer" } ], "category": "vendor", "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG" } ] }, "vulnerabilities": [ { "cwes": [ { "id": "CWE-372", "name": "Incomplete Internal State Distinction", "version": "4.18" } ], "ids": [ { "system_name": "RustSec Advisory Database", "text": "RUSTSEC-2026-0285" }, { "system_name": "GitHub Security Advisory", "text": "GHSA-2mjx-qc3c-rqvc" }, { "system_name": "ndaal Advisory ID", "text": "ndaal-sa-2026-629" } ], "metrics": [ { "content": { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "cvss_v4": { "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE" } }, "products": [ "CSAFPID-0001" ] } ], "notes": [ { "category": "summary", "text": "ndaal SARIF Viewer 1.1.11 is affected by RUSTSEC-2026-0285 (GHSA-2mjx-qc3c-rqvc). ndaal SARIF Viewer 1.1.12 remediates it by advancing the `rustls` dependency 0.23.42 -> 0.23.45 in the 2026-09-16 `cargo update` sweep. CVSS v3.1 base score 5.3 (MEDIUM). Users of 1.1.11 and earlier releases resolving the affected version should upgrade to 1.1.12.", "title": "Change Summary" }, { "category": "description", "text": "rustls accepted a TLS 1.3 handshake message sent at the wrong encryption level when it followed a key-changing message inside the same record -- for example a plaintext EncryptedExtensions packed into the ServerHello record. RFC 8446 section 5.1 requires such a connection to be terminated with an unexpected_message alert. The handshake transcript remains authenticated, so a network-position attacker can neither alter nor complete a handshake through this flaw; the practical effect is that a peer could send handshake messages in plaintext that should have been encrypted without rustls rejecting the connection. For sarif-viewer the affected code is on the primary trust boundary: every request to the viewer's listener is terminated by this rustls version. Upstream notes the flaw is functionally the same as Go's GO-2026-4340 (CVE-2025-61730); that CVE is recorded here as related context only and is NOT an alias assigned to the rustls advisory. Versions below 0.23.13 are unaffected upstream; sarif-viewer 1.1.11 shipped 0.23.42 and is therefore affected.", "title": "Impact" }, { "category": "description", "text": "The CVSS v3.1 vector is the one published in the RUSTSEC advisory, not an ndaal re-assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3 (MEDIUM). The confidentiality-only LOW impact reflects that protocol messages intended to be encrypted could be accepted in the clear, while authentication and integrity of the handshake transcript hold. The v4.0 vector is derived from it by this repository's documented v3-to-v4 mapping so that both metrics describe the same finding. Note that the derived v4.0 vector computes 6.9 (MEDIUM) against the upstream v3.1 score of 5.3 (MEDIUM) for the same metric values: the uplift is inherent to how CVSS 4.0 weights an unauthenticated, network-reachable confidentiality impact and is not a second ndaal assessment of the flaw. CVSS v3.1 base score 5.3 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. CVSS v4.0 base score 6.9 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N.", "title": "CVSS Scoring Rationale" }, { "category": "details", "text": "rustls terminates TLS 1.3 for the viewer's HTTPS listener (src/tls.rs, src/server.rs), configured with default-features off plus the aws_lc_rs provider, prefer-post-quantum key exchange, logging and std. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"0.23\"; lockfile-only change. 0.23.45 is the first release in the 0.23 line carrying the fix for RUSTSEC-2026-0285. Folds the matching lockfile advances in the same TLS subtree: rustls-pki-types 1.15.0 -> 1.15.1, rustls-webpki 0.103.13 -> 0.103.15, and the aws-lc-rs cryptographic provider 1.17.1 -> 1.18.1 with its aws-lc-sys bindings 0.42.0 -> 0.45.0. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.", "title": "Dependency Change" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "RUSTSEC-2026-0285 in the RustSec advisory database", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0285" }, { "category": "external", "summary": "Upstream advisory GHSA-2mjx-qc3c-rqvc", "url": "https://github.com/advisories/GHSA-2mjx-qc3c-rqvc" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to ndaal SARIF Viewer 1.1.12, which resolves rustls 0.23.45 (from 0.23.42). Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"0.23\"; lockfile-only change. 0.23.45 is the first release in the 0.23 line carrying the fix for RUSTSEC-2026-0285.", "product_ids": [ "CSAFPID-0001" ] } ], "title": "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries in rustls (RUSTSEC-2026-0285)" } ] }