Check logs sprint 8.6 week 1

[rjayasekera]

Log review needs to be completed for Sprint 8.5 (week 1) per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

[fecjjeng]

Vulnerabilities found this week:

OPENFEC: Total 3

package.json: 0

requirements.txt: 1 MEDIUM

1. Race Condition : [Med] Snyk: Race Condition (due 5/20/19) #3642

flyway:2 HIGH

1. Man-in-the-Middle (MitM) : [High] fecgov/openFEC:data/flyway/build.gradle - need a fix by Apr. 28, 2019 #3654
2. Integer Overflow: [High] Snyk: Integer Overflow (due 5/17/19) #3706

FEC-EREGS: Total 2

package.json: 1 MEDIUM

1. Prototype Pollution :[Med] Snyk: Prototype Pollution (due 6/10/19) fec-eregs#439

requirements.txt: 1 MEDIUM

1. Race Condition: [Med] Snyk: Race Condition (due 5/20/19) fec-eregs#435

FEC-PATTERN-LIBRARY: Total 1

package.json: 1 MEDIUM

1. Prototype Pollution [Med] Snyk: Prototype Pollution (due 6/10/19) fec-pattern-library#135

FEC-CMS: Total 4
package.json: 1 HIGH, 2 MEDIUM

1. Arbitrary File Overwrite : HIGH [HIGH] Arbitrary File Overwrite -- need a fix by May 10, 2019 fec-cms#2821
2. Denial of Service (DoS) : MEDIUM [Med] Snyk: Denial of Service (DoS) (due 6/2/19) fec-cms#2792
3. Prototype Pollution: MEDIUM [Med] Snyk: Prototype Pollution (due 6/10/19) fec-cms#2823

requirements.txt: Total 1

1. Sandbox Escape: [Med] Snyk: Sandbox Escape (due 6/10/19) fec-cms#2822

Account approvals: NONE this week.

Search logs: No new users added/removed

Cloud.gov Dashboard: 9 deployer accounts, same as last week.

[fecjjeng]

complete and close the ticket.