Check logs sprint 14.3 - week 2 (3/31)

[lbeaufort]

Log review needs to be completed per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

• open tickets for Sprint 14.4

[johnnyporkchops]

FEC-CMS:

package.json: 2
Medium: Regular Expression Denial of Service with ua-parser (fecgov/fec-cms#4392)
High: Underscore Arbitrary Code Execution fecgov/fec-cms#4523
requirements.txt: 3
Medium: lxml Cross-site scripting (XSS): fecgov/fec-cms#4509
Medium: Web Cache Poisoning : fecgov/fec-cms#4426
Low: Directory Traversal : fecgov/fec-cms#4363

OPEN-FEC:

requirements.txt: 1
High: Deserialization of Untrusted Data: #4818

FEC-EREGS:

requirements.txt: 1
Low: Directory Traversal: fecgov/fec-eregs#563

FEC-PATTERN-LIBRARY:
None

Search logs:
No log results for "user change"

Cloud.gov Dashboard:
9 deployer accounts, same as last week.

Offboarding:
None

Onboarding:
Add Slack access for Mark Dcruz of AWS #370