Check logs sprint 6.4 (Maj. Don West) week 1

[rjayasekera]

Log review needs to be completed for Maj. Don West (Sprint 6.4) week 1 per the Security Event Review Checklist

[lbeaufort]

FEC-CMS: 5 total
package.json - 1 High, 1 Medium
Regular Expression Denial of Service (ReDoS) [HIGH] fecgov/fec-cms#2163
Regular Expression Denial of Service (DoS) [MED] fecgov/fec-cms#1953

requirements.txt - 1 High, 2 Medium
Arbitrary Code Execution [HIGH] fecgov/fec-cms#2182
Information Exposure #1 [MED] fecgov/fec-cms#1954
Information Exposure #2 [MED] fecgov/fec-cms#1955

OPENFEC: 1 total
flyway: 1 High, not applicable. I hit "ignore" but documented this for our records. #3279
package.json: 0
requirements.txt: 1 High
Arbitrary Code Execution [HIGH] #3280

FEC-EREGS: 1 total
Arbitrary Code Execution [HIGH] fecgov/fec-eregs#414

None
FEC-PATTERN-LIB: 3 total
Regular Expression Denial of Service (ReDoS) [MED] fecgov/fec-pattern-library#116
Two low risk issues(reported on Snyc) [LOW] fecgov/fec-pattern-library#117

Add/Update User Account

None
Deployer Accounts/Service Keys
10 service keys found on cloud.gov under fec-beta-fec org