AiSOC v20.2.1 — security patch for GHSA-9m2j-23jf-gg3p (phishing header ReDoS)

[beenuar]

AiSOC v20.2.1 is out: https://github.com/beenuar/AiSOC/releases/tag/v20.2.1

A security patch, no breaking changes. It closes GHSA-9m2j-23jf-gg3p (medium), responsibly reported by q7256 — thank you.

What it was: the phishing header analysis scanned a reported message's From display name with an unanchored regex. A long display name with no address-like substring made that scan quadratic — 33 seconds for 128 KB in our measurement, 71 in the reporter's — and because POST /api/v1/phishing/reports runs the analysis synchronously on the event loop, one crafted phishing report stalled every other request on the API process, health checks included. The endpoint is reachable by the default analyst role.

What changed: the scan is now linear (interior match starts fail in constant time, with the match set provably unchanged), and the display name is analysed on its first kilobyte only — RFC 5322 caps a header line at 998 octets, so anything beyond that is already pathological. The same cap keeps the impersonation finding's stored evidence bounded. 128 KB now completes in 26 ms. The regression test was demonstrated failing on the pre-fix tree, demonstrated failing again under a reverted-fix negative control, and every other regex in the phishing package was audited for the same class — the one suspicious-looking sibling was measured linear and deliberately left unchanged.

Who should upgrade: anyone on v19.0.0 through v20.2.0 who provisions analyst accounts. docker pull the v20.2.1 tags, or helm upgrade to chart 7.11.1. Neither stable channel moves.

Full details in the advisory and the [20.2.1] section of CHANGELOG.md.