Certificate not verified by GitHub Actions pipeline command

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_109
Category	Data Protection
Severity	MEDIUM

Impact

Not verifying certificates through pipeline commands allows attackers to plant their own certificate and impersonate a server in order to perform a man-in-the-middle attack to intercept, tamper with and/or steal information, to possibly run code in the build system and to reach the production environment.