fecgov / openFEC

The first RESTful API for the Federal Election Commission. We're aiming to make campaign finance more accessible for journalists, academics, developers, and other transparency seekers.
https://api.open.fec.gov/developers
Other
483 stars 106 forks source link

Check logs Sprint 25.6 Week 2 #5909

Closed fec-jli closed 3 months ago

fec-jli commented 4 months ago

Log review needs to be completed per the Security Event Review Checklist (https://github.com/fecgov/FEC/wiki/Security-Event-Review-Checklist)

Ref: https://github.com/fecgov/openFEC/issues/5908

tmpayton commented 3 months ago

Note: The following issues were logged based off snyk cli in addition to snyk dashboard.

FEC-CMS: 4 package.json: 0 requirements.txt: 4 [Snyk Medium - zipp Infinite loop] (https://github.com/fecgov/fec-cms/issues/6367) [Snyk Medium - urllib3@1.26.18 Improper Removal of Sensitive Information Before Storage or Transfer] -(https://github.com/fecgov/fec-cms/issues/6343) [Snyk Medium - fix 4 issues: django Denial of Service (DoS,Directory Traversal ,Timing Attack)] -(https://github.com/fecgov/fec-cms/issues/6376) [Snyk: High - Regular Expression Denial of Service (ReDoS)] -(https://github.com/fecgov/fec-cms/issues/6394)

OpenFEC: 3 package.json: 0 data/flyway/build.gradle: 0 requirements.txt: 3 [Snyk Medium - urllib3@1.26.18 Improper Removal of Sensitive Information Before Storage or Transfer] -(https://github.com/fecgov/openFEC/issues/5877) [Snyk Medium - Infinite loop] - (https://github.com/fecgov/openFEC/issues/5898) [Snyk: Medium - Insufficient Verification of Data Authenticity] -(https://github.com/fecgov/openFEC/issues/5914)

Pattern-Library: 0

Search logs: "User changes" not found in the past week. Deployer accounts from cloud.gov dashboard: 10