Check logs sprint 19.1 week 1

[cnlucas]

Log review needs to be completed per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

Ref: Check logs PI 18 Innovation week 3

[rfultz]

FEC-EREGS:
package.json: None
requirements.txt:

• 1 existing: [Snyk:HIGH] django Reflected File Download (RFD) (due by 09/10/2022)

requirements-parsing.txt:

• 1 existing: [Snyk:HIGH] django Reflected File Download (RFD) (due by 09/10/2022)

OPENFEC:
package.json: None
requirements.txt: None
flyway:

• 1 existing: [SNYK: Medium] org.bouncycastle:bcprov-jdk15on Cryptographic Issues & io.netty:netty-handler Improper Certificate Validation (Due 08/28/2022)
• 2 NEW:

  • [SNYK: HIGH] org.postgresql:postgresql SQL Injection (Due 2022-09-17)
    https://app.snyk.io/org/fecgov/project/e6c155e9-f0ac-4a49-98fa-83c24f5b74b3#issue-SNYK-JAVA-ORGPOSTGRESQL-2970521

  • [SNYK: Medium] io.netty:netty-handler Improper Certificate Validation (Due 2022-10-17)
    https://app.snyk.io/org/fecgov/project/e6c155e9-f0ac-4a49-98fa-83c24f5b74b3#issue-SNYK-JAVA-IONETTY-1042268

FEC-CMS:
package.json: None
requirements.txt: None

• 2 existing:
  • [Snyk:HIGH] django Reflected File Download (RFD) (due by 09/10/2022)
  • [Snyk:Medium] pyjwt- Use of a Broken or Risky Cryptographic Algorithm (due by 07/24/2022)

FEC-PATTERN-LIBRARY:
package.json: None

Search logs:
No log results for "User change"

Cloud.gov Dashboard:
8 deployer accounts

Off-boarding:
None in Github or Cloud.gov this week

[rfultz]

Reviewed and tickets created