Check logs sprint 6.5 (Penny Robinson) week 1

[rjayasekera]

Log review needs to be completed for Penny Robinson (Sprint 6.5) week 1 per the Security Event Review Checklist

[pkfec]

FEC-CMS: #4

• package.json - 1 High, 1 Medium

  • [HIGH] Regular Expression Denial of Service (ReDoS) [High risk] underscore.string ReDoS vulnerability fec-cms#2163
  • [MED] Regular Expression Denial of Service (DoS) [Med risk] Bleach DOS vulnerability fec-cms#1953

• requirements.txt - 2 Medium

  • [MED] Information Exposure [Med risk] Django information exposure #1 fec-cms#1954
  • [MED] Django Module ReDoS vulnerability [Medium Risk] Django module ReDoS vulnerability fec-cms#2217

OPENFEC: #1

• package.json
  • None
• requirements.txt: 1
  • [HIGH] Arbitrary Code Execution [HIGH] [Med] Snyk - Arbitrary Code Execution (due 9/10) #3280
• flyway
  • None

FEC-EREGS: #0

• package.json
  • None
• requirements.txt
  • None

FEC-PATTERN-LIB: #3

• package.json
  • [MED] ua-parser-js module - Regular Expression Denial of Service (ReDoS) [Med risk] ua-parser-js module - Regular Expression Denial of Service (ReDoS) fec-pattern-library#116
  • [LOW] Two low risk modues : lodash and braces [Low risk] Two vulnerabilities introduced through @frctl/fractal@1.1.7 and @frctl/nunjucks@1.0.3 fec-pattern-library#117

Add/Update User Account : #1

• Don Michael from Information Division is added as a wagtail user and also added cloud.gov account .https://github.com/18F/fec-accounts/issues/139

Deployer Accounts/Service Keys : #10

• 10 service keys found on cloud.gov under fec-beta-fec org

[pkfec]

completed the log review on 07/25/2018.