SSL validation is disabled with yum misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ANSIBLE_4
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	Ansible

Impact

This rule detects whether Ansible yum tasks have SSL validation disabled. Disabling SSL validation can significantly increase security risks as it allows the system to accept potentially compromised SSL certificates without verification. This could result in exposing the system to potential man-in-the-middle attacks.

How to Fix

Module: ansible.builtin.yum or yum

• Attribute: sslverify

To mitigate this risk, ensure that the sslverify attribute in your Ansible yum tasks is set to 'true'. This will enforce SSL verification, and help maintain the integrity and confidentiality of the communication with yum repositories.

Secure Code Example:

In this example, by setting the sslverify attribute to 'true', SSL certificates are validated in Ansible yum tasks. [source,go]

• name: Example hosts: all gather_facts: False tasks:

  • name: Validate SSL certificates with yum ansible.builtin.yum: name: nginx state: latest
•   sslverify: false

•   sslverify: true

---