Check logs PI 13 Innovation Sprint week 3

[jason-upchurch]

Check logs PI 13 Innovation Sprint week 3

• Log review needs to be completed for PI 13 Innovation Sprint week 3 per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

• Open issues for checking logs for rest of 13 (13.7--innovation 2) PI 14 Sprint 1 week 1 and 2

[jason-upchurch]

FEC-CMS:

• package.json: 3
  • High: Arbitrary Code Execution ([Snyk: High] Arbitrary Code Execution in sanitize-html (due 10/9/20) fec-cms#4026)
  • Medium: Prototype Pollution ([Snyk: Medium] package.json - Prototype Pollution (due 12/06/2020) fec-cms#4105)
  • Medium: Denial of Service ([Snyk: Medium] package.json - Denial of Service (due 11/16/20) fec-cms#4043)
• requirements.txt: 1
  • High: HTTP Header Injection. ([Snyk: High] requirement - HTTP Header Injection (due 11/06/2020) fec-cms#4106)

OPEN-FEC:

• package.json: 0
• requirements.txt: 0
• data/flyway/build.gradle: 0

FEC-EREGS:

• package.json: 0
• requirements.txt: 0

FEC-PATTERN-LIBRARY:

• package.json: 0

Cloud.gov Dashboard:
9 deployer accounts, same as last week.

Offboarding:
Nothing to report