misp-website/_posts/2017-07-12-MISP.2.4.77.rele...

33 lines
2.3 KiB
Markdown
Raw Normal View History

2017-07-12 16:51:28 +02:00
---
title: MISP 2.4.77 released
layout: post
featured: /assets/images/misp-small.png
---
A new version of MISP [2.4.77](https://github.com/MISP/MISP/tree/v2.4.77) has been released including security fixes, bug fixes and various improvements.
This version includes multiple security fixes reported by cert.govt.nz including:
- Some security settings including GnuPG/SMIME passwords for the signing keys used for notifications in MISP and the redis password are now redacted from the server settings accessible via the UI.
- Sanitisation of template uploader view in regards to file names has been tightened.
- Avoid any data leakage through exceptions thrown by the GFI uploader on failed parsing when debug mode is enabled. Replaced by instead giving proper a warnings via flash messages.
2017-07-12 16:51:28 +02:00
- Hashing algorithm updated to bcrypt for new users and updated transparently for existing users at the next login.
- All profile edit pages now require the user's or admin's password to be confirmed to limit the impact on potential session hijacking.
A significant speed improvement on the feed pull has been done for the CSV/freetext import especially for very large feeds. This speed improvement partially carries over to any tasks that add attributes to already large events.
2017-07-12 16:51:28 +02:00
Screenshots are now included in search results to better support users actively sharing image artefacts using MISP.
2017-07-12 16:51:28 +02:00
A host of minor and visual improvements were introduced.
2017-07-12 16:51:28 +02:00
MISP taxonomies, galaxies and PyMISP updated to the latest version. New default feeds (e.g. dataplane.org) have been added.
2017-07-12 16:51:28 +02:00
The full change log is available [here](https://www.misp.software/Changelog.txt).
Don't hesitate to [open an issue](https://github.com/MISP/MISP/issues) if you have any feedback, found a bug or want to propose new features.
We would like to thank all the contributors and users who reported issues or ideas in order to improve MISP. A special thank for the security report
from cert.govt.nz, we always appreciate security analysis of MISP. Don't hesitate to forward any security report (PGP encrypted) to us [via CIRCL](https://www.circl.lu/report/).
Don't forget our [MISP summit 0x3](https://2017.hack.lu/misp-summit/) before the [hack.lu](https://2017.hack.lu/) 2017 conference which will take place from 14:00 to 18:00, Monday 16 October 2017.