Mutable orb used in the pipeline

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_196
Category	Supply Chain
Severity	MEDIUM

Impact

Volatile or development orbs are mutable, as they can be overwritten with new versions. Malicious actors who gain control of the registry will be able to push a malicious orb with an existing version. The orb will be pulled automatically by the pipeline, leading to code execution in the pipeline.

Recommended Solution - Buildtime

It is recommended to use immutable production orbs which follow semver (semantic versioning) [Major].[Minor].[Patch], as they cannot be deleted or edited.

For additional information, refer to: https://circleci.com/docs/orb-concepts/#semantic-versioning.