Check logs sprint 8.6 week 2

[rjayasekera]

Log review needs to be completed for Sprint 8.5 (week 2) per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

[jason-upchurch]

Vulnerabilities found this week:

FEC-CMS: Total 5
package.json: 1 HIGH, 2 MEDIUM

1. Arbitrary File Overwrite : HIGH [HIGH] Arbitrary File Overwrite -- need a fix by May 10, 2019 fec-cms#2821
2. Denial of Service (DoS) : MEDIUM [Med] Snyk: Denial of Service (DoS) (due 6/2/19) fec-cms#2792
3. Prototype Pollution: MEDIUM [Med] Snyk: Prototype Pollution (due 6/10/19) fec-cms#2823

requirements.txt: 1 HIGH, 1 MEDIUM

1. CRLF Injection: HIGH [HIGH] CRLF injection -- need a fix by May 24, 2019 fec-cms#2862
2. Sandbox Escape: MEDIUM [Med] Snyk: Sandbox Escape (due 6/10/19) fec-cms#2822

OPENFEC: Total 3
package.json: 0

requirements.txt: 1 HIGH, 1 MEDIUM

1. CRLF Injection: HIGH [HIGH] CRLF injection -- need a fix by May 24, 2019 #3722
2. Race Condition : MEDIUM [Med] Snyk: Race Condition (due 5/20/19) #3642

flyway:2 HIGH

1. Man-in-the-Middle (MitM) : 1 HIGH: Snyk is recommending upgrade to org.postgresql:postgresql@42.2.5 driver, which we currently have, therefore Laura has marked it as a false positive.
2. Integer Overflow: [High] Snyk: Integer Overflow (due 5/17/19) #3706

FEC-EREGS: Total 3

package.json: 1 MEDIUM

1. Prototype Pollution : MEDIUM [Med] Snyk: Prototype Pollution (due 6/10/19) fec-eregs#439

requirements.txt: 1 HIGH, 1 MEDIUM

1. CRLF injection: HIGH [HIGH] CRLF injection fix by May 24, 2019 fec-eregs#442
2. Race Condition: MEDIUM [Med] Snyk: Race Condition (due 5/20/19) fec-eregs#435

FEC-PATTERN-LIBRARY: Total 1

package.json: 1 MEDIUM

1. Prototype Pollution [Med] Snyk: Prototype Pollution (due 6/10/19) fec-pattern-library#135

Account approvals: One issue added: https://github.com/fecgov/fec-accounts/issues/174

Search logs: No new users added/removed

Cloud.gov Dashboard: 9 deployer accounts, same as last week.

Offboarding: Ticket https://github.com/fecgov/fec-accounts/issues/173 needs to be assigned