[Med] Snyk - Man-in-the-Middle - django (due 9/1/19)

[lbeaufort]

Man-in-the-Middle (MitM)
Vulnerable module: django
Introduced through: django-libsass@0.7, django-jinja@2.4.1 and others
Detailed paths
Introduced through: project@0.0.0 › django-libsass@0.7 › django-compressor@2.3 › django-appconf@1.0.3 › django@1.11.20
Introduced through: project@0.0.0 › django-jinja@2.4.1 › django@1.11.20
Introduced through: project@0.0.0 › cg-django-uaa@1.3.0 › django@1.11.20
Introduced through: project@0.0.0 › django@1.11.20

Remediation
Upgrade django to version 1.11.22, 2.1.10, 2.2.3 or higher.

https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-451300

To do

• Be sure to check Wagtail dependencies and which version of Django it's compatible with.
• Test on Wagtail CMS to make sure Django upgrade didn't break Wagtail features or any other CMS features.

[jason-upchurch]

Requested wagtail access through fec-accounts repo.

[jason-upchurch]

Initially updated django@1.11.20 to django@2.2.1 but current wagtail@2.2.1 requires django < 2.2.1. The only version upgrade available <2.2.1 is django@1.1.22

added to requirements.txt and ran snyk test --file=requirements.txt from fec-cms and no vulnerabilities were detected. Need to test wagtail.

[jason-upchurch]

pytest passes. Will deploy to dev on 8/1 to test.

[jason-upchurch]

thank you @lbeaufort for the Django Roadmap which details django@1.11 as LTS until at least April 2020: https://www.djangoproject.com/weblog/2015/jun/25/roadmap/

[jason-upchurch]

Upgrade to django@1.11.22 introduces 4 new medium severity vulnerabilities:

✗ Medium severity vulnerability found in django
  Description: Denial of Service (Memory Exhaustion)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456540
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

✗ Medium severity vulnerability found in django
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456541
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22
  and 1 more...

✗ Medium severity vulnerability found in django
  Description: Denial of Service (DoS)
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456542
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

✗ Medium severity vulnerability found in django
  Description: SQL Injection
  Info: https://snyk.io/vuln/SNYK-PYTHON-DJANGO-456566
  Introduced through: django@1.11.22, cg-django-uaa@1.3.0, django-jinja@2.4.1, django-libsass@0.7
  From: django@1.11.22
  From: cg-django-uaa@1.3.0 > django@1.11.22
  From: django-jinja@2.4.1 > django@1.11.22

Will upgrade under this PR to django@1.11.23