Attributed metadata history

MISP 2.5.46 released - security hardening, major performance gains, knowledge-base updates and Overmind moving forward

MISP 2.5.46 is out, and the project continues to move at a very active development pace. This release brings together a large security review, significant performance improvements, major updates to the MISP knowledge bases and submodules, many fixes contributed by the community, and another substantial round of work on Overmind, the evolving MISP user interface. The volume and diversity of changes in this release also reflect the current activity around MISP: development, security reviews, performance work, knowledge-base maintenance, UI improvements and external contributions are all happening continuously across the project. Major security hardening A large part of this release is dedicated to improving MISP's security posture. A new shared UrlEgressValidator introduces a common policy for outbound URL requests, validating schemes and resolved addresses and blocking loopback, link-local and private destinations where appropriate. CurlClient has also been extended with: host pinning; controlled and validated redirects; response size limits; TLS peer verification enabled by default. These changes provide the foundation for securing the different places where MISP retrieves remote resources. Several concrete SSRF-related issues have consequently been addressed, including: event report URL imports; feed redirects; TAXII discovery; credential forwarding during redirects; access to internal or private network destinations. The security review also resulted in a broad range of additional fixes: rejection of empty and non-string LDAP and LinOTP credentials; session ID rotation after CustomAuth authentication; brute-force protection for email OTP verification; improved CSRF protection across user settings and dashboard actions; conversion of numerous state-changing GET requests to POST; stricter sharing-group authorisation; enforcement of perm_modify when deleting attributes; access-control enforcement in the OnDemand correlation engine; ACL checks for collection objects, graph references, feeds and cryptographic keys; SVG sandboxing for inline-served organisation logos and report pictures; prevention of stored and reflected XSS through URL and event filtering parameters; protection against path manipulation in server-side file deletion; redaction of information that should not be exposed to insufficiently privileged users; improved authentication-failure logging and throttling. Many of these issues were identified during the extensive review performed with the Scottish Government – National Cyber Team, by elhoim (David André), and through additional internal review. A big thank you to everyone involved in this work. Significant performance improvements This release also contains some important performance work. Event report counts Event report counts on event indexes previously resulted in one count query per event. The new implementation performs grouped queries instead. For a default page containing 60 events, this reduces roughly 60 database round trips to one or two queries depending on the user context. Benchmarks with a real MariaDB instance showed improvements in the range of roughly 19× to 35× for this operation. Sightings retrieval Sightings attached during MispAttribute::fetchAttributes() are now fetched in batches rather than individually for every attribute. Previously, a 50,000-attribute batch could potentially trigger a huge number of database queries. The new implementation groups the work into chunked queries while preserving the existing sightings policies and ACL behaviour. In the benchmark used during development, the sighting attachment step went from: 8.109 seconds / 10,661 queries to: 0.149 seconds / 6 queries for a 5,000-attribute test case — more than a 50× reduction for that part of the processing path. This should particularly benefit large instances and high-volume export or REST API workloads. Major updates to MISP galaxies, warning lists and knowledge bases MISP 2.5.46 is also accompanied

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.