Closed fec-jli closed 3 months ago
Note: The following issues were logged based off snyk cli in addition to snyk dashboard.
FEC-CMS: 4 package.json: 0 requirements.txt: 4 [Snyk Medium - zipp Infinite loop] (https://github.com/fecgov/fec-cms/issues/6367) [Snyk Medium - urllib3@1.26.18 Improper Removal of Sensitive Information Before Storage or Transfer] -(https://github.com/fecgov/fec-cms/issues/6343) [Snyk Medium - fix 4 issues: django Denial of Service (DoS,Directory Traversal ,Timing Attack)] -(https://github.com/fecgov/fec-cms/issues/6376) [Snyk: High - Regular Expression Denial of Service (ReDoS)] -(https://github.com/fecgov/fec-cms/issues/6394)
OpenFEC: 3 package.json: 0 data/flyway/build.gradle: 0 requirements.txt: 3 [Snyk Medium - urllib3@1.26.18 Improper Removal of Sensitive Information Before Storage or Transfer] -(https://github.com/fecgov/openFEC/issues/5877) [Snyk Medium - Infinite loop] - (https://github.com/fecgov/openFEC/issues/5898) [Snyk: Medium - Insufficient Verification of Data Authenticity] -(https://github.com/fecgov/openFEC/issues/5914)
Pattern-Library: 0
Search logs: "User changes" not found in the past week. Deployer accounts from cloud.gov dashboard: 10
Log review needs to be completed per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)
Ref: https://github.com/fecgov/openFEC/issues/5908