Check logs Sprint 13 innovation#2 - week 4 (2/17)

[pkfec]

Log review needs to be completed for Sprint 13 innovation#2 week 4 per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

• open tickets for Sprint 14.1

[lbeaufort]

FEC-CMS:

• package.json: 2 old, 3 new (combined)

  • High: (blocked) Arbitrary Code Execution ([Snyk: High] Arbitrary Code Execution in sanitize-html (due 10/9/20) fec-cms#4026)
  • High (new): Command Injection ([Snyk: High] Command Injection (due 3/19/21) fec-cms#4390)
  • Medium: Access Restriction Bypass and Validation Bypass (combined) [Snyk: Med] Access Restriction Bypass and Validation Bypass(due 4/12/21) fec-cms#4379 (https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/#issue-SNYK-JS-SANITIZEHTML-1070786 and https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/#issue-SNYK-JS-SANITIZEHTML-1070780)
  • Medium (new): Regular Expression Denial of Service with lodash ([Snyk: Med] Regular Expression Denial of Service with lodash (4/18/21) fec-cms#4391)
  • Medium (new): Regular Expression Denial of Service with ua-parser ([Snyk: MED] Regular Expression Denial of Service with ua-parser-js (due 4/18/21) fec-cms#4392)

• requirements.txt: 2 existing

  • MEDIUM: Regular Expression Denial of Service (ReDoS) (https://app.snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994) [Snyk: MED] Regular Expression Denial of Service (ReDoS) (due 04/04/2021) fec-cms#4362
  • LOW: Directory Traversal (https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-1066259) [Snyk: LOW] Directory Traversal (due 05/04/2021) fec-cms#4363

OPEN-FEC:

• package.json: 2 new
  • High (new): Command Injection ([Snyk: High] Command Injection (due 3/19/21) #4766)
    [Snyk: High] Command Injection (due 3/19/21) #4766
  • Medium (new): Regular Expression Denial of Service ([Snyk: Med] Regular Expression Denial of Service (4/18/21) #4767)

FEC-EREGS:

• requirements.txt: 1
  • LOW: Directory Traversal: [Snyk: Low -Research] Directory Traversal (due 05/04/2021) fec-eregs#563

FEC-PATTERN-LIBRARY:
None

Search logs:
OK

Cloud.gov Dashboard:
9 deployer accounts, same as last week.

Offboarding:
None