Check logs sprint 14.2 - week 1 (3/10)

[hcaofec]

Log review needs to be completed per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

[patphongs]

FEC-CMS:

• package.json: 4 existing, 1 high, 3 medium)

  • High: (blocked) Arbitrary Code Execution ([Snyk: High] Arbitrary Code Execution in sanitize-html (due 10/9/20) fec-cms#4026)
  • Medium: Access Restriction Bypass and Validation Bypass (combined) [Snyk: Med] Access Restriction Bypass and Validation Bypass(due 4/12/21) fec-cms#4379 (https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/#issue-SNYK-JS-SANITIZEHTML-1070786 and https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/#issue-SNYK-JS-SANITIZEHTML-1070780)
  • Medium: Regular Expression Denial of Service with ua-parser ([Snyk: MED] Regular Expression Denial of Service with ua-parser-js (due 4/18/21) fec-cms#4392)

• requirements.txt: 3 existing, 2 existing temporarily ignored

  • High: (blocked) Out-of-bounds Read ([Snyk: Low] Pillow Out-of-bounds Read (6/2/21) fec-cms#4443)
    • Not considered a high vulnerability as this is under authentication. See comment for further details. Set to ignore for 90 days.
  • High: (blocked) Regular Expression Denial of Service (ReDoS) ([Snyk: Low] Pillow Regular Expression Denial of Service (ReDoS) (6/2/21) fec-cms#4444)
    • Not considered a high vulnerability as this is under authentication. See comment for further details. Set to ignore for 90 days.
  • Medium: Regular Expression Denial of Service (ReDoS) (https://app.snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994) [Snyk: MED] Regular Expression Denial of Service (ReDoS) (due 04/04/2021) fec-cms#4362
  • Medium: Web Cache Poisoning (https://app.snyk.io/org/fecgov/project/ff0dca01-794e-4c1c-bf1f-0c0f8932fadd#issue-SNYK-PYTHON-DJANGO-1076802) [SNYK: MEDIUM] Web Cache Poisoning (Due: 4/25/2021) fec-cms#4426
  • Low: Directory Traversal (https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-1066259) [Snyk: LOW] Directory Traversal (due 05/04/2021) fec-cms#4363

OPEN-FEC:
None

FEC-EREGS:

• requirements.txt: 1 existing
  • Low: Directory Traversal: [Snyk: Low -Research] Directory Traversal (due 05/04/2021) fec-eregs#563

FEC-PATTERN-LIBRARY:
None

Search logs:
1 new member onboarded 🔒

Cloud.gov Dashboard:
9 deployer accounts, same as last week.

Offboarding:
None