Check logs sprint 6.5 (Penny Robinson) week 2

[rjayasekera]

Log review needs to be completed for Penny Robinson (Sprint 6.5) week 2 per the Security Event Review Checklist

[rjayasekera]

FEC-CMS: #4

• package.json - 1 High, 1 Medium

  • [HIGH] Regular Expression Denial of Service (ReDoS) - [High risk] underscore.string ReDoS vulnerability fec-cms#2163
  • [MED] Regular Expression Denial of Service (DoS) - [Med risk] Bleach DOS vulnerability fec-cms#1953

• requirements.txt - 1 High

  • [HIGH] Arbitrary Code Execution - [MED] Arbitrary Code Execution (Due 09/10/18) fec-cms#2236

OPENFEC: #1

• package.json
  • None
• requirements.txt: 1
  • [HIGH] Arbitrary Code Execution [HIGH] - [Med] Snyk - Arbitrary Code Execution (due 9/10) #3280
• flyway
  • None

FEC-EREGS: #0

• package.json
  • None
• requirements.txt
  • None

FEC-PATTERN-LIB: #3

• package.json
  • [MED] ua-parser-js module - Regular Expression Denial of Service (ReDoS) - [Med risk] ua-parser-js module - Regular Expression Denial of Service (ReDoS) fec-pattern-library#116
  • [MED] chownr - Time of Check Time of Use (TOCTOU) - [MED] chownr - Time of Check Time of Use (TOCTOU) (Due 09/30/18) fec-pattern-library#127
  • [LOW] Two low risk modues : lodash and braces - [Low risk] Two vulnerabilities introduced through @frctl/fractal@1.1.7 and @frctl/nunjucks@1.0.3 fec-pattern-library#117

Add/Update User Account : #1

• Don Michael from Information Division is added as a wagtail user and also added cloud.gov account .https://github.com/18F/fec-accounts/issues/139 . Issue closed.

Deployer Accounts/Service Keys : #10

• 10 service keys found on cloud.gov under fec-beta-fec org